Combined security and QOS coordination among devices

ABSTRACT

A method includes establishing a wireless link between a wireless interface of an endpoint and a WAP; exchanging, through the wireless link, network traffic associated with execution of an application at the endpoint; executing, at the endpoint, a security routine to monitor a security status of the endpoint; establishing, through the wireless link, a secure channel that shares the wireless link with the network traffic of the application, the secure channel to extend from the security routine to a supervisor through the wireless link and the WAP; conveying, from the security routine and through the secure channel, an indication of the security status; receiving, at the security routine and through the secure channel, a command to change a setting of the wireless interface associated with a characteristic of the wireless link; and accessing, from the security routine, the wireless interface to effect the change in response to receiving the command.

CROSS-REFERENCE TO RELATED APPLICATIONS

This application claims priority to United Kingdom Pat. App. No.1610171.9 filed on Jun. 10, 2016, which is incorporated herein byreference in its entirety.

BACKGROUND

Wireless networks have supplanted wired networks in many home andworkplace settings. In many places, such networks are deemed to be“internal” networks that provide access to devices and/or otherresources that are deemed to be private or even sensitive in nature.This arises from the efficiency and convenience of wireless networks,and a growing trend of installing one or more wireless access points(WAPs) in a home, office, building, open spaces, outside spaces adjacentto buildings, throughout campuses, etc.

Such increased usage of wireless networking technology brings thechallenge of security for the network and the challenge of maintainingquality of service (QOS) in the wireless network access provided to eachendpoint from each WAP. Individual WAPs may incorporate technology tomonitor the QOS of a portion of a wireless network, but are oftenlimited in their ability to improve QOS.

SUMMARY

A computer-implemented method to provide security and wireless networkservice may include: establishing a wireless link between a wirelessinterface of an endpoint and a wireless access point (WAP); exchanging,through the wireless link, network traffic associated with execution ofan application by a processor of the endpoint; executing, by theprocessor of the endpoint, a security routine to monitor a securitystatus of the endpoint; establishing, through the wireless link, asecure channel that shares the wireless link with the network traffic ofthe application, the secure channel to extend from the security routineto a supervisor through the wireless link and the WAP; conveying, fromthe security routine and through the secure channel, an indication ofthe security status; receiving, at the security routine and through thesecure channel, a command to change a setting of the wireless interfaceassociated with a characteristic of the wireless link; and accessing,from the security routine, the wireless interface to effect the changeof the setting in the wireless interface in response to receiving thecommand.

A computer-implemented method to provide security and wireless networkservice, the method may include: establishing a wireless link between awireless interface of an endpoint and a wireless access point (WAP);exchanging, through the wireless link, network traffic associated withexecution of an application by a processor of the endpoint;establishing, through the wireless link, a secure channel that sharesthe wireless link with the network traffic of the application;transmitting, through the secure channel, an indication of a securitystatus of the endpoint; and receiving, through the secure channel, acommand to change a setting of the wireless interface associated with acharacteristic of the wireless link.

The computer-implemented method may include extending the secure channelfrom the security routine to a firewall or a supervisor through thewireless link and the WAP.

The computer-implemented method may include executing, by the processorof the endpoint, a security routine to monitor the security status ofthe endpoint.

The computer-implemented method may include designating a portion of astorage of the endpoint in which the security routine is stored duringexecution as restricted from access by at least the application.

The computer-implemented method may include generating, by the executionof the security routine, the indication of the security status, whereinthe indication of the security status may include at least one of anindication of security health of the endpoint, an indication ofsuspicious activity by the application, an indication of compromise ofthe application, an indication of compromise of the endpoint, anindication of commencement of execution of the application, anindication of cessation of execution of the application, an indicationof an observed data rate of the network traffic associated withexecution of the application, and an indication of an observed patternof a time of execution of the application.

The computer-implemented method may include accessing, from the securityroutine, the wireless interface to effect the change of the setting inthe wireless interface in response to receiving the command.

The computer-implemented method may include isolating the access to thewireless interface by the security routine from a network device driverassociated with the wireless interface.

The setting may include at least one of a frequency of the wirelesslink, an encoding of the network traffic, a signal strength oftransmission of the network traffic by the wireless interface, a datatransmission rate through the wireless link, and a protocol timing ofthe wireless link.

A non-transitory machine-readable medium with instructions storedthereon that, when executed by a processor, may cause the processor to:establish a wireless link between a wireless interface of an endpointand a wireless access point (WAP); exchange, through the wireless link,network traffic associated with execution of an application of theendpoint; establish, through the wireless link, a secure channel thatshares the wireless link with the network traffic of the application;transmit, through the secure channel, an indication of a security statusof the endpoint; and receive, through the secure channel, a command tochange a setting of the wireless interface associated with acharacteristic of the wireless link.

The instructions may further cause the processor to extend the securechannel from the security routine to a firewall or a supervisor throughthe wireless link and the WAP.

The instructions may further cause the processor to execute a securityroutine to monitor the security status of the endpoint.

The instructions may further cause the processor to designate a portionof a storage of the endpoint in which the security routine is storedduring execution as restricted from access by at least the application.

The indication of the security status may include at least one of anindication of security health of the endpoint, an indication ofsuspicious activity by the application, an indication of compromise ofthe application, an indication of compromise of the endpoint, anindication of commencement of execution of the application detected bythe security routine, an indication of cessation of execution of theapplication detected by the security routine, an indication of anobserved data rate of the network traffic associated with execution ofthe application, and an indication of an observed pattern of a time ofexecution of the application.

The instructions may further cause the processor to access the wirelessinterface to effect the change of the setting in the wireless interfacein response to receiving the command.

The instructions may further cause the processor to isolate the accessto the wireless interface from a network device driver associated withthe wireless interface and executed by the processor.

The setting may further include at least one of a frequency of thewireless link, an encoding of the network traffic, a signal strength oftransmission of the network traffic by the wireless interface, and aprotocol timing of the wireless link.

An apparatus to provide security and wireless network service mayinclude a processor of an endpoint; a wireless interface of the endpointcoupled to the processor; and a storage of the endpoint coupled to theprocessor to store instructions, that when executed by the processorcause the processor to: establish a wireless link between the wirelessinterface and a wireless access point (WAP); exchange, through thewireless link, network traffic associated with execution of anapplication by the processor; establish, through the wireless link, asecure channel that shares the wireless link with the network traffic ofthe application; transmit, through the secure channel, an indication ofa security status of the endpoint; and receive, through the securechannel, a command to change a setting of the wireless interfaceassociated with a characteristic of the wireless link.

The processor may be further caused to extend the secure channel fromthe security routine to a firewall or a supervisor through the wirelesslink and the WAP.

The processor may be further caused to execute a security routine tomonitor the security status of the endpoint.

The processor may be further caused to designate a portion of thestorage in which the security routine is stored during execution asrestricted from access by at least the application.

The processor may be further caused to generate, by the execution of thesecurity routine, the indication of the security status, wherein theindication of the security status may include at least one of anindication of security health of the endpoint, an indication ofsuspicious activity by the application, an indication of compromise ofthe application, an indication of compromise of the endpoint, anindication of commencement of execution of the application by theprocessor, an indication of cessation of execution of the application bythe processor, an indication of an observed data rate of the networktraffic associated with execution of the application, and an indicationof an observed pattern of a time of execution of the application.

The processor may be further caused to access, by execution of thesecurity routine, the wireless interface to effect the change of thesetting in the wireless interface in response to receiving the command.

The processor may be further caused to isolate the access to thewireless interface by the security routine from a network device driverassociated with the wireless interface.

The setting may include at least one of a frequency of the wirelesslink, an encoding of the network traffic, a signal strength oftransmission of the network traffic by the wireless interface, a datatransmission rate through the wireless link, and a protocol timing ofthe wireless link.

A computer-implemented method to provide security and wireless networkservice may include: establishing a wireless link between a wirelessinterface of a wireless access point (WAP) and an endpoint; exchangingnetwork traffic with the endpoint through the wireless link;authenticating a security routine executed by a processor of theendpoint; establishing, through the wireless link and the WAP, and inresponse to authentication of the security routine, a secure channelthat shares the wireless link with the network traffic; recurringlyreceiving an indication of a security status the endpoint through atleast the secure channel; monitoring performance of the wireless link;deriving a change to a setting associated with a characteristic of thewireless link based on the performance of the wireless link; andtransmitting a command to the endpoint to change the setting through atleast the secure channel.

A computer-implemented method to provide security and wireless networkservice may include establishing a first wireless link between awireless interface of a first wireless access point (WAP) and a firstendpoint; exchanging network traffic with the first endpoint through thefirst wireless link; exchanging, through the first wireless link,messages associated with a first secure channel that shares the firstwireless link with the network traffic; recurringly receivingindications of a security status of the first endpoint through at leastthe first secure channel; and transmitting a first command to the firstendpoint to change a first setting associated with a characteristic ofthe first wireless link through at least the first secure channel.

The computer-implemented method may include routing the network trafficthrough the first WAP between the first wireless link and a firewall,wherein the firewall is incorporated into or is coupled to the firstWAP; and exchanging the messages associated with the first securechannel between a security routine of the endpoint and the firewall.

The computer-implemented method may include authenticating, at thefirewall, the security routine of the first endpoint; and conditioningestablishment of the first secure channel on the authentication of thesecurity routine.

The indication of the security status may include at least one of anindication of commencement of execution of an application by a processorof the first endpoint and an indication of cessation of execution of theapplication by the processor of the first endpoint, and the method mayfurther include deriving the first command based on the security status,wherein the first command may include at least one of a change to thefirst setting to increase a data transfer rate of the first wirelesslink in response to commencement of execution of the application and achange to the first setting to decrease the data transfer rate of thefirst wireless link in response to cessation of execution of theapplication.

The computer-implemented method may include monitoring performance ofthe first wireless link; and deriving the change of the first settingbased on the performance of the first wireless link.

The computer-implemented method may include deriving, at the first WAP,a change to a second setting associated with a characteristic of asecond wireless link established between the first WAP and a secondendpoint, wherein the change to the second setting is based on thechange to the first setting; and transmitting a second command to thesecond endpoint to change the second setting through at least a secondsecure channel established through the second wireless link.

The computer-implemented method may include deriving a change to asecond setting associated with a characteristic of a second wirelesslink established between a second WAP and a second endpoint, wherein thechange to the second setting is based on the change to the firstsetting; and transmitting a second command to the second endpoint tochange the second setting through a second secure channel establishedthrough the second WAP and the second wireless link.

The computer-implemented method may include deriving a pattern of use ofthe first wireless link by an application of the first endpoint, whereinthe pattern of use recurs on at least one of a time of day and a day ofa week; and transmitting the first command to the first endpoint inresponse to reaching the at least one of the time of day and the day ofa week.

A non-transitory machine-readable medium with instructions storedthereon that, when executed by a processor, may cause the processor to:establish a first wireless link between a wireless interface of a firstwireless access point (WAP) and a first endpoint; exchange networktraffic with the first endpoint through the first wireless link;exchange, through the first wireless link, messages associated with afirst secure channel that shares the first wireless link with thenetwork traffic; recurringly receive indications of a security status ofthe first endpoint through at least the first secure channel; andtransmit a first command to the first endpoint to change a first settingassociated with a characteristic of the first wireless link through atleast the first secure channel.

The instructions may further cause the processor to: route the networktraffic through the first WAP between the first wireless link and afirewall, wherein the firewall is incorporated into or is coupled to thefirst WAP; and exchange the messages associated with the first securechannel between a security routine of the endpoint and the firewall.

The instructions may further cause the processor to authenticate, at thefirewall, the security routine of the first endpoint; and conditionestablishment of the first secure channel on the authentication of thesecurity routine.

The indication of the security status may include at least one of anindication of commencement of execution of an application by a processorof the first endpoint and an indication of cessation of execution of theapplication by the processor of the first endpoint; and the processormay be further caused to derive the first command based on the securitystatus, wherein the first command may include at least one of a changeto the first setting to increase a data transfer rate of the firstwireless link in response to commencement of execution of theapplication and a change to the first setting to decrease the datatransfer rate of the first wireless link in response to cessation ofexecution of the application.

The instructions may further cause the processor to monitor performanceof the first wireless link and derive the change of the first settingbased on the performance of the first wireless link.

The instructions may further cause the processor to: derive a change toa second setting associated with a characteristic of a second wirelesslink established between the first WAP and a second endpoint, whereinthe change to the second setting is based on the change to the firstsetting; and transmit a second command to the second endpoint to changethe second setting through a secure channel established through thesecond wireless link.

The instructions may further cause the processor to: derive a change toa second setting associated with a characteristic of a second wirelesslink established between a second WAP and a second endpoint, wherein thechange to the second setting is based on the change to the firstsetting; and transmit a second command to the second endpoint to changethe second setting through a second secure channel established throughthe second WAP and the second wireless link.

The instructions may further cause the processor to: derive a pattern ofuse of the first wireless link by an application of the first endpoint,wherein the pattern of use recurs on at least one of a time of day and aday of a week; and transmit the first command to the first endpoint inresponse to reaching the at least one of the time of day and the day ofa week.

An apparatus to provide security and wireless network service mayinclude: a processor of a first wireless access point (WAP); a wirelessinterface of the first WAP coupled to the processor; and a storage ofthe first WAP coupled to the processor to store instructions, that whenexecuted by the processor cause the processor to: establish a firstwireless link between the wireless interface and a first endpoint;exchange network traffic with the first endpoint through the firstwireless link; exchange, through the first wireless link, messagesassociated with a first secure channel that shares the first wirelesslink with the network traffic; recurringly receive indications of asecurity status of the first endpoint through at least the first securechannel; and transmit a first command to the first endpoint to change afirst setting associated with a characteristic of the first wirelesslink through at least the first secure channel.

The processor may be further caused to: route the network trafficthrough the first WAP between the first wireless link and a firewall,wherein the firewall is incorporated into or is coupled to the firstWAP; and exchanging the messages associated with first secure channelbetween a security routine of the endpoint and the firewall.

The processor may be further caused to: authenticate, at the firewall,the security routine of the first endpoint; and condition establishmentof the first secure channel on the authentication of the securityroutine.

The indication of the security status may include at least one of anindication of commencement of execution of an application by a processorof the first endpoint and an indication of cessation of execution of theapplication by the processor of the first endpoint; and the processormay be further caused to derive the first command based on the securitystatus, wherein the first command may include at least one of a changeto the first setting to increase a data transfer rate of the firstwireless link in response to commencement of execution of theapplication and a change to the first setting to decrease the datatransfer rate of the first wireless link in response to cessation ofexecution of the application.

The processor may be further caused to monitor performance of the firstwireless link and derive the change of the first setting based on theperformance of the first wireless link.

The processor may be further caused to: derive a change to a secondsetting associated with a characteristic of a second wireless linkestablished between the first WAP and a second endpoint, wherein thechange to the second setting is based on the change to the firstsetting; and transmit a second command to the second endpoint to changethe second setting through a secure channel established through thesecond wireless link.

The processor may be further caused to: derive a change to a secondsetting associated with a characteristic of a second wireless linkestablished between a second WAP and a second endpoint, wherein thechange to the second setting is based on the change to the firstsetting; and transmit a second command to the second endpoint to changethe second setting through a second secure channel established throughthe second WAP and the second wireless link.

The processor may be further caused to derive a pattern of use of thefirst wireless link by an application of the first endpoint, wherein thepattern of use recurs on at least one of a time of day and a day of aweek; and transmit the first command to the first endpoint in responseto reaching the at least one of the time of day and the day of a week.

A system to maintain security and wireless network service in a facilitymay include: a first wireless access point (WAP) in communication with afirst endpoint via a first wireless link; a second WAP in communicationwith a second endpoint via a second wireless link; and a firewall, thatmay include a processor and a non-transitory machine-readable mediumwith instructions stored thereon. When executed by the processor, theinstructions may cause the processor to perform operations including:establish a first secure channel with the first WAP; establish a secondsecure channel with the second WAP; establish a third secure channelwith the first endpoint via the first wireless link; establish a fourthsecure channel with the second endpoint via the second wireless link;receive a first report from the first WAP, the first report includingfirst WAP security status information and first WAP wireless networkstatus information; receive a second report from the second WAP, thesecond report including second WAP security status information andsecond WAP wireless network status information; receive a third reportfrom the first endpoint, the third report including first endpointsecurity status information and wireless network status information;determine network configuration changes based on the first report, thesecond report, and the third report, the network configuration changesintended to improve quality of service (QOS); and transmit a command toimplement the network configuration changes to the first endpoint overthe third secure channel, wherein the command directs the first endpointto end communication with the first WAP and to establish communicationwith the second WAP.

A computer implemented method to maintain security and wireless networkservice may include: establishing, by a firewall, respective securechannels with each of a plurality of wireless access points (WAPs) andeach of a plurality of endpoints; receiving, by the firewall, aplurality of reports communicated over the respective secure channelsfrom the plurality of WAPs and the plurality of endpoints, each of theplurality of reports including security status information and wirelessnetwork status information; deriving network configuration changes basedon one or more of the reports; and transmitting commands to at least asubset of the plurality of endpoints, the commands to directimplementation of the network configuration changes.

The network configuration changes may be derived based on the securitystatus information.

The network configuration changes may be derived based on an occurrenceof a security event.

The security event may have occurred on one of the endpoints of theplurality of endpoints.

The security event may have occurred on one of the WAPs.

The network configuration changes may be derived to improve networkperformance.

The network configuration changes may be derived based on wirelessnetwork status information.

The network configuration changes may be derived in response to networkcongestion detected in wireless network status information.

The network configuration changes may include switching a coupling ofone endpoint of the plurality of endpoints from a coupling through afirst wireless link with a first WAP of the plurality of WAPs to acoupling through a second wireless link to a second WAP of the pluralityof WAPs.

The network configuration changes may include changing a wirelessnetwork channel or data transmission rate.

The network configuration changes may include balancing assignment ofthe endpoints to the WAPs.

The balancing may be based on availability of the WAPs to the endpoints.

A network device may include: a processor; and a non-transitorymachine-readable medium with instructions stored thereon that, whenexecuted by the processor, cause the processor to perform operationsincluding: establish secure channels with each of a plurality ofwireless access points (WAPs) and each of a plurality of endpoints;receive a plurality of reports communicated over the respective securechannels from the plurality of WAPs and the plurality of endpoints, eachof the plurality of reports including security status information andwireless network status information; derive network configurationchanges based on one or more of the reports; and transmit commands to atleast a subset of the endpoints, the commands to direct implementationof the network configuration changes.

The network configuration changes may be derived based on the securitystatus information.

The network configuration changes may be derived based on an occurrenceof a security event.

The network configuration changes may be derived to improve networkperformance.

The network configuration changes may be derived based on wirelessnetwork status information.

The network configuration changes may include switching a coupling ofone endpoint of the plurality of endpoints from a coupling through afirst wireless link with a first WAP of the plurality of WAPs to acoupling through a second wireless link to a second WAP of the pluralityof WAPs.

The network configuration changes may include changing a wirelessnetwork channel or data transmission rate.

A computer-implemented method to maintain security and wireless networkservice in a facility may include: establishing, by a firewall, a firstsecure channel with a first wireless access point (WAP) and a secondsecure channel with a second WAP; establishing, by the firewall, a thirdsecure channel with an endpoint through a wireless link between theendpoint and the first WAP; receiving a first report from the first WAP,the first report including first WAP security status information andfirst WAP wireless network status information; receiving a second reportfrom the second WAP, the second report including second WAP securitystatus information and second WAP wireless network status information;receiving a third report from the endpoint, the third report includingendpoint security status information and wireless network statusinformation; deriving network configuration changes based on the firstreport, the second report, and the third report, the networkconfiguration changes intended to improve quality of service (QOS); andtransmitting a commands to the first WAP over the first secure channel,to the second WAP over the second secure channel, and to the endpointover the third secure channel, wherein the commands directimplementation of the network configuration changes.

A network device may include a processor; and a non-transitorymachine-readable medium with instructions stored thereon. When executedby the processor, the instructions may cause the processor to performoperations including: establish a first secure channel with a firstwireless access point (WAP) and a second secure channel with a secondWAP; establish a third secure channel with an endpoint through awireless link between the endpoint and the first WAP; receive a firstreport from the first WAP, the first report including first WAP securitystatus information and first WAP network status information; receive asecond report from the second WAP, the second report including secondWAP security status information and second WAP wireless network statusinformation; receive a third report from the endpoint, the third reportincluding endpoint security status information and wireless networkstatus information; derive network configuration changes based on thefirst report, the second report, and the third report, the networkconfiguration changes intended to improve quality of service (QOS); andtransmit commands to the first WAP over the first secure channel, to thesecond WAP over the second secure channel, and to the endpoint over thethird secure channel, wherein the commands direct implementation of thenetwork configuration changes.

BRIEF DESCRIPTION OF THE DRAWINGS

This disclosure is illustrated by way of example, and not by way oflimitation, in the accompanying figures in which like reference numeralsare used to refer to similar elements.

FIG. 1 illustrates an example implementation of a threat managementenvironment according to at least some implementations.

FIG. 2 illustrates an example implementation of computer systemaccording to at least some implementations.

FIG. 3 illustrates an example implementation of a threat managementsystem according to at least some implementations.

FIGS. 4A, 4B, 4C and 4D each illustrate an example implementation of anetworking system according to at least some implementations.

FIGS. 5A, 5B and 5C each illustrate an example implementation of devicesof a networking system according to at least some implementations.

FIGS. 6A, 6B and 6C each illustrate an example implementation ofwireless communications according to at least some implementations.

FIG. 7 illustrates an example implementation of coordination within anetworking system to change a characteristic of a single wireless linkaccording to at least some implementations.

FIGS. 8A and 8B each illustrates an example implementation ofcoordination within a networking system to change characteristics ofmultiple wireless links according to at least some implementations.

FIGS. 9A and 9B, together, illustrate an example of coordination ofchanges in wireless links between WAPs and endpoints according to atleast some implementations.

FIG. 10 illustrates a flow diagram according to at least someimplementations.

FIG. 11 illustrates a flow diagram according to at least someimplementations.

FIG. 12 illustrates a flow diagram according to at least someimplementations.

FIG. 13 illustrates a flow diagram according to at least someimplementations.

FIG. 14 illustrates a flow diagram according to at least someimplementations.

FIG. 15 illustrates a flow diagram according to at least someimplementations.

FIG. 16 illustrates a flow diagram according to at least someimplementations.

FIG. 17 illustrates a flow diagram according to at least someimplementations.

DETAILED DESCRIPTION

Implementations will now be described with reference to the accompanyingfigures. The implementations may, however, be embodied in many differentforms and should not be construed as limited to the illustrated examplesset forth herein.

Various implementations of a method include exchanging securityinformation, such as indications of a security status of an endpoint,and networking information, such as commands to improve quality ofservice (QOS) of a wireless link, through a secure channel establishedthrough the wireless link. The wireless link may extend between theendpoint and a wireless access point (WAP), and the secure channelshares the wireless link with other network traffic exchanged betweenthe endpoint and WAP. The secure channel may extend beyond one end ofthe wireless link and to a security routine executed within the endpointin a manner secured from access or interference by other routines thatare also executed within the endpoint. The secure channel may extendbeyond the other end of the wireless link and through the WAP to atleast a firewall or a server that serves as a supervisor.Implementations of the method may include monitoring one or morecharacteristics of the wireless link, deriving at least one change to atleast one characteristic of the wireless link, and transmitting acommand to make the at least one change through the secure channel tothe security routine in response to at least one characteristic fallingoutside of a threshold. Such implementations may include the securityroutine operating a wireless interface of the endpoint to affect the atleast one change to the wireless link specified in the command.Implementations of the method may include monitoring the security statusof the endpoint and recurringly transmitting the indications thereof toat least the firewall through the secure channel for analysis. Invarious implementations, an endpoint, a WAP, a firewall, a supervisor,and/or a networking system may each perform at least a portion of themethod.

Various implementations of a networking system establish secure channelswithin wireless links established with endpoints to enable coordinationwith security routines executed by the endpoints to maintain securityand to enable coordination of the network, for example to improve atleast one characteristic of the wireless links. The networking systemmay include at least one WAP to provide the wireless links to theendpoints and at least one firewall to establish the secure channelswithin at least a subset of the wireless links. In some implementations,the at least one firewall may serve as a gateway for the endpoints toanother network, such as the Internet. The endpoints may access suchanother network through the wireless links established with the at leastone WAP, and the at least one firewall. At least in implementations thatinclude numerous WAPs and/or firewalls, the networking system mayinclude at least one server, which may be a WAP, a firewall, or a cloudserver, for example, that serves as a supervisor. The supervisor may beaccessible to the at least one firewall through such another network asthe Internet.

Within each endpoint, a processor may execute a security routine tomonitor the security status of the endpoint. At least a portion of thesecurity routine may be maintained within a secure zone during itsexecution to prevent access thereto and/or interference therewith byother routines that may also be executed within the endpoint, includingone or more of an operating system (OS), device drivers, applicationsand/or malware. The security routine may, for example, monitor resourcerequests and resources used by applications. The security routine mayscan portions of other routines for patterns of instructions and/orsequences of bits that match known pieces of malware and/or may monitorthe execution of other routines for patterns of behavior that may beassociated with malware. Alternatively or additionally, the securityroutine may employ any of a variety of techniques to detect and/ormitigate the behavior of malware.

One or more other routines executed within the endpoint, such as an OSand/or a network driver may interact with a wireless communicationdevice such as a radio incorporated into, coupled to or otherwiseassociated with the endpoint, to communicate with a WAP of thenetworking system to establish a wireless link between the endpoint andthe WAP to enable network communications therewith. With the wirelesslink established, the one or more other routines may engage in exchangesof network traffic therethrough for any of a variety of purposes,including exchanges of application data such as emails and/or instantmessages, downloads of media files and/or program data, such asapplications, etc. The security routine may exchange securitycredentials and/or otherwise cooperate with a firewall of the networkingsystem to be authenticated therewith through the wireless link and theWAP. Following such authentication, the firewall may establish a securechannel with the security routine through the wireless link and the WAP.Thus, the secure channel may share the wireless link with the networktraffic engaged in by the one or more other routines executed within theendpoint. In some implementations, authentication of the securityroutine may be entirely separate from any authentication that may be aprerequisite to earlier establishment of the wireless link between theendpoint and the WAP. In this way, the secure channel may be securedfrom interference by the one or more other routines executed within theendpoint.

Through the secure channel, the security routine may recurringlytransmit indications of the security status of the endpoint. Suchrecurring transmissions may be made on a recurring interval of timeand/or may be triggered by events detected by the security routinewithin the endpoint, including instances of having detected a potentialor actual threat, such as a compromising of security of the endpoint, apolicy violation, malware and/or having taken action against a piece ofmalware. Such recurring transmissions may provide a form of security“heartbeat” signal for another device, such as a firewall to recurringlyanalyze in connection with monitoring the security status of theendpoint.

Also through the secure channel, the security routine may send orreceive networking information, such as a command to change a settingwithin the wireless interface of the endpoint by which the endpointestablished and maintains the wireless link. Such a command to change asetting may include a change to a radio frequency, an encoding of data,a selection of protocols, a protocol timing, etc. In response to thecommand, the security routine may access the wireless interface toeffect the change specified in the command, and may do so bycommunicating with or in a manner that bypasses a network driver orother routine that may otherwise normally access and control thewireless interface.

A WAP of the networking system may establish wireless links withendpoints that may come within range of thereof. Such a WAP may serve asa router to route network traffic engaged in by one or more routines ofan endpoint between the wireless link established with the endpoint anda firewall, which in turn, may serve as a gateway to another networksuch as the Internet. Where a security routine of the endpoint and thefirewall establish a secure channel through the wireless link and theWAP, the WAP may also route the secure channel between the wireless linkand the firewall alongside other network traffic.

In some implementations, the WAP may also monitor the QOS of thewireless link to identify instances in which an aspect of the QOS fallsoutside a QOS threshold. Such a threshold may include a minimum rate ofdata throughput to be maintained, a maximum delay in performing aportion of a protocol not to be exceeded, a number of devices connectedto or attempting to connect to the WAP, a configuration of wirelessdevices connected to or attempting to connect to the WAP, etc. Inresponse to an aspect of the QOS of the wireless link having fallenoutside a QOS threshold and/or in response to a predicted or anticipatedpossibility of an aspect of the QOS of the wireless link falling outsidea QOS threshold, a processor of the WAP may derive a change in acharacteristic of the wireless link to improve the QOS of the wirelesslink. However, beyond improving and/or maintaining the QOS to the extentof preventing aspects of the QOS from falling outside one or more QOSthresholds, further improvement in the QOS may be defined by furtherrefinement of various aspects to enable the data throughput of thewireless link to be further increased.

In some implementations, a WAP may also monitor one or morecharacteristics of a wireless link to identify instances in which one ofthose characteristics falls outside a threshold that may specify aminimum, a maximum and/or some other limitation of a characteristic.Such a characteristic may include, for example, a carrier frequency, anamplitude, a signal-to-noise ratio, an aspect of a shape of a waveform,a bandwidth, a separation between frequencies employed by differentchannels, a frequency shift, a shift in a waveform, a malformedtransition in a waveform, a synchronization characteristic, a droppedportion of a protocol, a data error rate, a dropped packet rate, etc.Such characteristics may be associated with one or more aspects of QOSof the wireless link, and accordingly, an instance of such acharacteristic falling outside a threshold may be associated with anaspect of QOS falling outside a QOS threshold such as a minimum rate ofdata throughput to be maintained, a maximum delay in performing aportion of a protocol not to be exceeded, etc. In response to one ormore characteristics of the link falling outside a threshold and/or inresponse to an anticipated or predicted possibility of one or morecharacteristics of the link falling outside a threshold, a processor ofthe WAP may derive a change to make in one or more characteristics ofthe wireless link to improve the QOS of the wireless link. It should benoted that the one or more characteristics that are found to have fallenoutside a threshold and/or are predict to fall outside a threshold maynot coincide with the one or more characteristics to which a change isderived to be effected. Instead the various physical properties of awireless link, whether based on radio frequency (RF) technology, or not,may be relied upon to provide a relationship among two or morecharacteristics of the wireless link that may be exploited.

Where a change is able to be effected by a WAP without cooperation withanother device, the WAP may proceed with effecting the change. Where atleast a portion of the change may be effected by the endpoint (e.g.,where the change involves coordination on both ends of the wirelesslink), the WAP may, for example, transmit a request for a firewall orsupervisor to transmit a command to the endpoint (e.g., the securityroutine of the endpoint) to make the change. The request may be made toeffect the change immediately, or for example, at a particular time, orupon the occurrence of a specified event, such as when there has been nooutgoing network traffic from the endpoint for a defined period of time.The request may be made to the endpoint to facilitate the change andminimize user disruption. Upon receiving the request, the firewall orsupervisor may transmit the command to the security routine executedwithin the endpoint through the secure channel, and the security routinemay then effect the change specified in the command. In someimplementations, requests to change a characteristic may be directed tomultiple endpoints. In some implementations, changes also may becoordinated with one or more WAPs, one or more firewalls, one or morerouters, gateways, and/or other networking infrastructure devices aswell as one or more endpoints.

A firewall may serve as a gateway to another network, such as theInternet. In so doing, the firewall may impose various limits on theaccess it provides to such another network in accordance with one ormore rules. Alternatively or additionally, the firewall may analyzevarious characteristics of the network traffic that passes through itbetween such another network and one or more WAPs to identify portionsof the network traffic that should not be allowed to pass through thefirewall. For example, a firewall may analyze the contents of packetsexchanged in the network traffic for data patterns indicative ofmalware. For example, a firewall may evaluate the history or reputationof one or more network addresses with which network traffic isexchanged.

The firewall may authenticate a security routine executed within anendpoint. In response to a successful authentication, the firewall mayestablish a secure channel with the security routine that extendsthrough the WAP and the wireless link that are between the firewall andthe endpoint. The firewall may receive indications of the securitystatus of the endpoint through the secure channel. The firewall and thesecurity routine may exchange security related information as part ofcooperating in any of a variety of ways to maintain security againstcompromise. The firewall and the security routine also may exchangenetwork-related information, such as information about the status of awireless link or the network, signal quality, noise/interference levels,statistics, etc., as well as commands to configure or adjust the accessor use of the network. For example, the firewall may receive a requestto transmit a command to the security routine of an endpoint toconfigure or adjust network-related parameters, such as to make a changein a setting that affects a characteristic of the wireless linkestablished between the WAP and the endpoint in which the securityroutine is executed, such as interface configurations, connectionspeeds, parameter settings, etc., to direct the endpoint to use adifferent protocol or channel, or to direct the endpoint to connect to adifferent WAP. In response, the firewall may transmit that command tothe security routine via the secure channel such that the secure channelis employed to convey information and/or commands related to bothsecurity and network QOS.

In some implementations, a change to be made in a network parameter,such as a characteristic of a wireless link may require coordinationwith another WAP, instead of or in addition to coordination with asecurity routine executed within an endpoint. By way of example,improving the QOS of a wireless link may require a change in such acharacteristic as frequency that may interfere with one or more otherwireless links associated with another nearby WAP. In someimplementations, the WAP may exchange communications with the other WAPand/or devices connected to that other WAP through the firewall tocoordinate changes to be made in wireless links by both WAPs.Alternatively or additionally, each WAP may recurringly transmitcharacteristics of wireless links established with endpoints to thefirewall along with indications of the level of QOS observed in thosewireless links. In such implementations, the firewall may derive changesthat are to be made to multiple wireless links in a coordinated manner,and may transmit commands to multiple WAPs and/or security routinesexecuted within endpoints to effect those changes in a coordinatedmanner. As another example, if an endpoint is directed to connect to adifferent WAP, the different WAP may be provided with connection androuting information relevant to the endpoint.

As previously discussed, some implementations of a networking system mayadditionally include one or more servers that serve as a supervisor. Thesupervisor may be included in a WAP, a firewall, and/or another device.The supervisor may establish secure channels with firewalls throughanother network (e.g., the Internet) to which each of those firewallsmay serve as a gateway. Each of the firewalls may recurringly exchangesecurity related information with the supervisor through the securechannel that is established between each and the supervisor. Inparticular, the supervisor may distribute security related updates tothe firewalls through those secure channels. The firewalls may, in turn,distribute appropriate ones of those updates to WAPs and/or the securityroutines executed within the endpoints. In at least situations in whicha change in a characteristic of a wireless link associated with one WAPcoupled to one firewall requires coordination with at least one otherWAP coupled to a different firewall, communications with those WAPsand/or those firewalls may be routed through the supervisor and/orotherwise coordinated by the supervisor. In some implementations,requests described here as made to a firewall may be passed on by afirewall to a supervisor. The supervisor may respond to the requests andcommunicate via the firewall as appropriate

FIG. 1 illustrates an environment for threat management. Specifically,FIG. 1 depicts a block diagram of a threat management system providingprotection to an enterprise against a plurality of threats—a context inwhich the following techniques may usefully be deployed. One aspectrelates to corporate policy management and implementation through aunified threat management facility 100. As will be explained in moredetail below, a threat management facility 100 may be used to protectcomputer assets from many threats, both computer-generated threats anduser-generated threats. The threat management facility 100 may bemulti-dimensional in that it may be designed to protect corporate assetsfrom a variety of threats and it may be adapted to learn about threatsin one dimension (e.g. worm detection) and apply the knowledge inanother dimension (e.g. spam detection). Policy management is one of thedimensions for which the threat management facility can provide acontrol capability. A corporation or other entity may institute a policythat prevents certain people (e.g. employees, groups of employees, typesof employees, guest of the corporation, etc.) from accessing certaintypes of computer programs. For example, the corporation may elect toprevent its accounting department from using a particular version of aninstant messaging service or all such services. In this example, thepolicy management facility 112 may be used to update the policies of allcorporate computing assets with a proper policy control facility or itmay update a select few. By using the threat management facility 100 tofacilitate the setting, updating and control of such policies thecorporation only needs to be concerned with keeping the threatmanagement facility 100 up to date on such policies. The threatmanagement facility 100 can take care of updating all of the othercorporate computing assets.

It should be understood that the threat management facility 100 mayprovide multiple services, and policy management may be offered as oneof the services. We will now turn to a description of certaincapabilities and components of the threat management system 100.

Over recent years, malware has become a problem across the Internet 154.From both a technical perspective and a user perspective, thecategorization of a specific threat type, whether as virus, worm, spam,phishing exploration, spyware, adware, or the like, is becoming reducedin significance. The threat, no matter how it is categorized, may needto be stopped at various points of a networked computing environment,such as one of an enterprise facility 102, including at one or morelaptops, desktops, servers, gateways, communication ports, handheld ormobile devices, firewalls, and the like. Similarly, there may be lessand less benefit to the user in having different solutions for known andunknown threats. As such, a consolidated threat management facility 100may need to apply a similar set of technologies and capabilities for allthreats. In certain implementations, the threat management facility 100may provide a single agent on the desktop, and a single scan of anysuspect file. This approach may eliminate the inevitable overlaps andgaps in protection caused by treating viruses and spyware as separateproblems, while simultaneously simplifying administration and minimizingdesktop load. As the number and range of types of threats has increased,so may have the level of connectivity available to all IT users. Thismay have led to a rapid increase in the speed at which threats may move.Today, an unprotected PC connected to the Internet 154 may be infectedquickly (perhaps within 10 minutes) which may require acceleration forthe delivery of threat protection. Where once monthly updates may havebeen sufficient, the threat management facility 100 may automaticallyand seamlessly update its product set against spam and virus threatsquickly, for instance, every five minutes, every minute, continuously,or the like. Analysis and testing may be increasingly automated, andalso may be performed more frequently; for instance, it may be completedin 15 minutes, and may do so without compromising quality. The threatmanagement facility 100 may also extend techniques that may have beendeveloped for virus and malware protection, and provide them toenterprise facility 102 network administrators to better control theirenvironments. In addition to stopping malicious code, the threatmanagement facility 100 may provide policy management that may be ableto control legitimate applications, such as VoIP, instant messaging,peer-to-peer file-sharing, and the like, that may undermine productivityand network performance within the enterprise facility 102.

The threat management facility 100 may provide an enterprise facility102 protection from computer-based malware, including viruses, spyware,adware, Trojans, intrusion, spam, policy abuse, uncontrolled access, andthe like, where the enterprise facility 102 may be any entity with anetworked computer-based infrastructure. In an implementation, FIG. 1may depict a block diagram of the threat management facility 100providing protection to an enterprise against a plurality of threats.The enterprise facility 102 may be corporate, commercial, educational,governmental, or the like, and the enterprise facility's 102 computernetwork may be distributed amongst a plurality of facilities, and in aplurality of geographical locations, and may include administration 134,a firewall 138A, an appliance 140A, server 142A, network devices 148A-B,clients 144A-D, such as protected by computer security facilities 152,and the like. It will be understood that any reference herein to clientfacilities may include the clients 144A-D shown in FIG. 1 andvice-versa. The threat management facility 100 may include a pluralityof functions, such as security management facility 122, policymanagement facility 112, update facility 120, definitions facility 114,network access rules facility 124, remedial action facility 128,detection techniques facility 130, testing facility 118, threat researchfacility 132, and the like. In implementations, the threat protectionprovided by the threat management facility 100 may extend beyond thenetwork boundaries of the enterprise facility 102 to include clients144D (or client facilities) that have moved into network connectivitynot directly associated or controlled by the enterprise facility 102.Threats to client facilities may come from a plurality of sources, suchas from network threats 104, physical proximity threats 110, secondarylocation threats 108, and the like. Clients 144A-D may be protected fromthreats even when the client 144A-D is not located in association withthe enterprise 102, such as when a client 144E-F moves in and out of theenterprise facility 102, for example when interfacing with anunprotected server 142C through the Internet 154, when a client 144F ismoving into a secondary location threat 108 such as interfacing withcomponents 140B, 142B, 148C, 148D that are not protected, and the like.In implementations, the threat management facility 100 may provide anenterprise facility 102 protection from a plurality of threats tomultiplatform computer resources in a plurality of locations and networkconfigurations, with an integrated system approach.

In implementations, the threat management facility 100 may be providedas a stand-alone solution. In other implementations, the threatmanagement facility 100 may be integrated into a third-party product. Anapplication programming interface (e.g. a source code interface) may beprovided such that the threat management facility 100 may be integrated.For instance, the threat management facility 100 may be stand-alone inthat it provides direct threat protection to an enterprise or computerresource, where protection is subscribed to directly 100. Alternatively,the threat management facility 100 may offer protection indirectly,through a third-party product, where an enterprise may subscribe toservices through the third-party product, and threat protection to theenterprise may be provided by the threat management facility 100 throughthe third-party product.

The security management facility 122 may include a plurality of elementsthat provide protection from malware to enterprise facility 102 computerresources, including endpoint security and control, email security andcontrol, web security and control, reputation-based filtering, controlof unauthorized users, control of guest and non-compliant computers, andthe like. The security management facility 122 may be a softwareapplication that may provide malicious code and malicious applicationprotection to a client facility computing resource. The securitymanagement facility 122 may have the ability to scan the client facilityfiles for malicious code, remove or quarantine certain applications andfiles, prevent certain actions, perform remedial actions and performother security measures. In implementations, scanning the clientfacility may include scanning some or all of the files stored to theclient facility on a periodic basis, scanning an application when theapplication is executed, scanning files as the files are transmitted toor from the client facility, or the like. The scanning of theapplications and files may be performed to detect known malicious codeor known unwanted applications. In an implementation, new malicious codeand unwanted applications may be continually developed and distributed,and updates to the known code database may be provided on a periodicbasis, on a demand basis, on an alert basis, or the like.

The security management facility 122 may provide email security andcontrol, where security management may help to eliminate spam, viruses,spyware and phishing, control of email content, and the like. Thesecurity management facility's 122 email security and control mayprotect against inbound and outbound threats, protect emailinfrastructure, prevent data leakage, provide spam filtering, and thelike. In an implementation, security management facility 122 may providefor web security and control, where security management may help todetect or block viruses, spyware, malware, unwanted applications, helpcontrol web browsing, and the like, which may provide comprehensive webaccess control enabling safe, productive web browsing. Web security andcontrol may provide Internet use policies, reporting on suspect devices,security and content filtering, active monitoring of network traffic,URI filtering, and the like. In an implementation, the securitymanagement facility 122 may provide for network access control, whichmay provide control over network connections. Network control may stopunauthorized, guest, or non-compliant systems from accessing networks,and may control network traffic that may not be bypassed from the clientlevel. In addition, network access control may control access to virtualprivate networks (VPN), where VPNs may be a communications networktunneled through another network, establishing a logical connectionacting as a virtual network. In implementations, a VPN may be treated inthe same manner as a physical network.

The security management facility 122 may provide host intrusionprevention through behavioral based protection, which may guard againstunknown threats by analyzing behavior before software code executes.Behavioral based protection may monitor code when it runs and interveneif the code is deemed to be suspicious or malicious. Advantages ofbehavioral based protection over runtime protection may include codebeing prevented from running. Whereas runtime protection may onlyinterrupt code that has already partly executed, behavioral protectioncan identify malicious code at the gateway or on the file servers anddelete the code before it can reach endpoint computers and the like.

The security management facility 122 may provide reputation filtering,which may target or identify sources of known malware. For instance,reputation filtering may include lists of URIs of known sources ofmalware or known suspicious IP addresses, or domains, say for spam, thatwhen detected may invoke an action by the threat management facility100, such as dropping them immediately. By dropping the source beforeany interaction can initiate, potential threat sources may be thwartedbefore any exchange of data can be made.

In implementations, information may be sent from the enterprise back toa third party, a vendor, or the like, which may lead to improvedperformance of the threat management facility 100. For example, thetypes, times, and number of virus interactions that a client experiencesmay provide useful information for the preventions of future virusthreats. This type of feedback may be useful for any aspect of threatdetection. Feedback of information may also be associated with behaviorsof individuals within the enterprise, such as being associated with mostcommon violations of policy, network access, unauthorized applicationloading, unauthorized external device use, and the like. Inimplementations, this type of information feedback may enable theevaluation or profiling of client actions that are violations of policythat may provide a predictive model for the improvement of enterprisepolicies.

The security management facility 122 may support overall security of theenterprise facility 102 network or set of enterprise facility 102networks, e.g., by providing updates of malicious code information tothe enterprise facility 102 network and associated client facilities.The updates may include a planned update, an update in reaction to athreat notice, an update in reaction to a request for an update, anupdate based on a search of known malicious code information, or thelike. The administration facility 134 may provide control over thesecurity management facility 122 when updates are performed. The updatesmay be automatically transmitted without an administration facility's134 direct control, manually transmitted by the administration facility134, or otherwise distributed. The security management facility 122 maymanage the receipt of malicious code descriptions from a provider,distribution of the malicious code descriptions to enterprise facility102 networks, distribution of the malicious code descriptions to clientfacilities, and so forth.

The threat management facility 100 may provide a policy managementfacility 112 that may be able to block non-malicious applications, suchas VoIP, instant messaging, peer-to-peer file-sharing, and the like,that may undermine productivity and network performance within theenterprise facility 102. The policy management facility 112 may be a setof rules or policies that may indicate enterprise facility 102 accesspermissions for the client facility, such as access permissionsassociated with the network, applications, external computer devices,and the like. The policy management facility 112 may include a database,a text file, a combination of databases and text files, or the like. Inan implementation, a policy database may be a block list, a black list,an allowed list, a white list, or the like that may provide a list ofenterprise facility 102 external network locations/applications that mayor may not be accessed by the client facility. The policy managementfacility 112 may include rules that may be interpreted with respect toan enterprise facility 102 network access request to determine if therequest should be allowed. The rules may provide a generic rule for thetype of access that may be granted. The rules may be related to thepolicies of an enterprise facility 102 for access rights for theenterprise facility's 102 client facility. For example, there may be arule that does not permit access to sporting websites. When a website isrequested by the client facility, a security facility may access therules within a policy facility to determine if the requested access isrelated to a sporting website. In an implementation, the securityfacility may analyze the requested website to determine if the websitematches with any of the policy facility rules.

The policy management facility 112 may be similar to the securitymanagement facility 122 but with the addition of enterprise facility 102wide access rules and policies that may be distributed to maintaincontrol of client facility access to enterprise facility 102 networkresources. The policies may be defined for application type, subset ofapplication capabilities, organization hierarchy, computer facilitytype, user type, network location, time of day, connection type, or thelike. Policies may be maintained by the administration facility 134,through the threat management facility 100, in association with a thirdparty, or the like. For example, a policy may restrict IM activity toonly support personnel for communicating with customers. This may allowcommunication for departments requiring access, but may maintain thenetwork bandwidth for other activities by restricting the use of IM toonly the personnel that need access to instant messaging (IM) in supportof the enterprise facility 102. In an implementation, the policymanagement facility 112 may be a stand-alone application, may be part ofthe network server facility 142, may be part of the enterprise facility102 network, may be part of the client facility, or the like.

The threat management facility 100 may provide configuration management,which may be similar to policy management, but may specifically examinethe configuration set of applications, operating systems, hardware, andthe like, and manage changes to their configurations. Assessment of aconfiguration may be made against a standard configuration policy,detection of configuration changes, remediation of improperconfiguration, application of new configurations, and the like. Anenterprise may keep a set of standard configuration rules and policieswhich may represent the desired state of the device. For example, aclient firewall may be running and installed, but in the disabled state,where remediation may be to enable the firewall. In another example, theenterprise may set a rule that disallows the use of USB disks, and sendsa configuration change to all clients, which turns off USB drive accessvia a registry.

The threat management facility 100 may also provide for the removal ofapplications that potentially interfere with the operation of the threatmanagement facility 100, such as competitor products that may also beattempting similar threat management functions. The removal of suchproducts may be initiated automatically whenever such products aredetected. In the case where such applications are services are providedindirectly through a third-party product, the application may besuspended until action is taken to remove or disable the third-partyproduct's protection facility.

Threat management against a quickly evolving malware environment mayrequire timely updates, and thus an update management facility 120 maybe provided by the threat management facility 100. In addition, a policymanagement facility 112 may also require update management (e.g., asprovided by the update facility 120 herein described). The updatemanagement for the security facility 122 and policy management facility112 may be provided directly by the threat management facility 100, suchas by a hosted system or in conjunction with the administration facility134. In implementations, the threat management facility 100 may providefor patch management, where a patch may be an update to an operatingsystem, an application, a system tool, or the like, where one of thereasons for the patch is to reduce vulnerability to threats.

The security facility 122 and policy management facility 112 may pushinformation to the enterprise facility 102 network and/or clientfacility. The enterprise facility 102 network and/or client facility mayalso or instead pull information from the security facility 122 andpolicy management facility 112 network server facilities 142, or theremay be a combination of pushing and pulling of information between thesecurity facility 122 and the policy management facility 112 networkservers 142, enterprise facility 102 network, and client facilities, orthe like. For example, the enterprise facility 102 network and/or clientfacility may pull information from the security facility 122 and policymanagement facility 112 network server facility 142 may request theinformation using the security facility 122 and policy managementfacility 112 update module; the request may be based on a certain timeperiod, by a certain time, by a date, on demand, or the like. In anotherexample, the security facility 122 and policy management facility 112network servers 142 may push the information to the enterprisefacility's 102 network and/or client facility by providing notificationthat there are updates available for download and then transmitting theinformation. The combination of the security management 122 networkserver facility 142 and security update module may functionsubstantially the same as the policy management facility 112 networkserver and policy update module by providing information to theenterprise facility 102 network and the client facility in a push orpull method. In an implementation, the policy management facility 112and the security facility 122 management update modules may work inconcert to provide information to the enterprise facility's 102 networkand/or client facility for control of application execution. In animplementation, the policy update module and security update module maybe combined into a single update module.

As threats are identified and characterized, the threat managementfacility 100 may create definition updates that may be used to allow thethreat management facility 100 to detect and remediate the latestmalicious software, unwanted applications, configuration and policychanges, and the like. The threat definition facility 114 may containthreat identification updates, also referred to as definition files. Adefinition file may be a virus identity file that may includedefinitions of known or potential malicious code. The virus identity(IDE) definition files may provide information that may identifymalicious code within files, applications, or the like. The definitionfiles may be accessed by security management facility 122 when scanningfiles or applications within the client facility for the determinationof malicious code that may be within the file or application. Thedefinition files may contain a number of commands, definitions, orinstructions, to be parsed and acted upon, or the like. Inimplementations, the client facility may be updated with new definitionfiles periodically to provide the client facility with the most recentmalicious code definitions; the updating may be performed on a set timeperiod, may be updated on demand from the client facility, may beupdated on demand from the network, may be updated on a receivedmalicious code alert, or the like. In an implementation, the clientfacility may request an update to the definition files from an updatefacility 120 within the network, may request updated definition filesfrom a computing facility external to the network, updated definitionfiles may be provided to the client facility 114 from within thenetwork, definition files may be provided to the client facility from anexternal computing facility from an external network, or the like.

A definition management facility 114 may provide timely updates ofdefinition files information to the network, client facilities, and thelike. New and altered malicious code and malicious applications may becontinually created and distributed to networks worldwide. Thedefinition files that maintain the definitions of the malicious code andmalicious application information for the protection of the networks andclient facilities may need continual updating to provide continualdefense of the network and client facility from the malicious code andmalicious applications. The definition files management may provide forautomatic and manual methods of updating the definition files. Inimplementations, the network may receive definition files and distributethe definition files to the network client facilities, the clientfacilities may receive the definition files directly, or the network andclient facilities may both receive the definition files, or the like. Inan implementation, the definition files may be updated on a fixedperiodic basis, on demand by the network and/or the client facility, asa result of an alert of a new malicious code or malicious application,or the like. In an implementation, the definition files may be releasedas a supplemental file to an existing definition files to provide forrapid updating of the definition files.

In a similar manner, the security management facility 122 may be used toscan an outgoing file and verify that the outgoing file is permitted tobe transmitted per the enterprise facility 102 rules and policies. Bychecking outgoing files, the security management facility 122 may beable discover malicious code infected files that were not detected asincoming files as a result of the client facility having been updatedwith either new definition files or policy management facility 112information. The definition files may discover the malicious codeinfected file by having received updates of developing malicious codefrom the administration facility 134, updates from a definition filesprovider, or the like. The policy management facility 112 may discoverthe malicious code infected file by having received new updates from theadministration facility 134, from a rules provider, or the like.

The threat management facility 100 may provide controlled access to theenterprise facility 102 networks. For instance, a manager of theenterprise facility 102 may want to restrict access to certainapplications, networks, files, printers, servers, databases, or thelike. In addition, the manager of the enterprise facility 102 may wantto restrict user access based on certain criteria, such as the user'slocation, usage history, need to know, job position, connection type,time of day, method of authentication, client-system configuration, orthe like. Network access rules may be developed for the enterprisefacility 102, or pre-packaged by a supplier, and managed by the threatmanagement facility 100 in conjunction with the administration facility134.

A network access rules facility 124 may be responsible for determiningif a client facility application should be granted access to a requestednetwork location. The network location may be on the same network as thefacility or may be on another network. In an implementation, the networkaccess rules facility 124 may verify access rights for client facilitiesfrom within the network or may verify access rights of computerfacilities from external networks. When network access for a clientfacility is denied, the network access rules facility 124 may send aninformation file to the client facility containing. For example, theinformation sent by the network access rules facility 124 may be a datafile. The data file may contain a number of commands, definitions,instructions, or the like to be parsed and acted upon through theremedial action facility 128, or the like. The information sent by thenetwork access facility rules facility 124 may be a command or commandfile that the remedial action facility 128 may access and take actionupon.

The network access rules facility 124 may include databases such as ablock list, a black list, an allowed list, a white list, an unacceptablenetwork site database, an acceptable network site database, a networksite reputation database, or the like of network access locations thatmay or may not be accessed by the client facility. Additionally, thenetwork access rules facility 124 may incorporate rule evaluation; therule evaluation may parse network access requests and apply the parsedinformation to network access rules. The network access rule facility124 may have a generic set of rules that may be in support of anenterprise facility's 102 network access policies, such as denyingaccess to certain types of websites, controlling instant messengeraccesses, or the like. Rule evaluation may include regular expressionrule evaluation, or other rule evaluation method for interpreting thenetwork access request and comparing the interpretation to theestablished rules for network access. In an implementation, the networkaccess rules facility 124 may receive a rules evaluation request fromthe network access control and may return the rules evaluation to thenetwork access control.

Similar to the threat definitions facility 114, the network access rulefacility 124 may provide updated rules and policies to the enterprisefacility 102. The network access rules facility 124 may be maintained bythe network administration facility 134, using network access rulesfacility 124 management. In an implementation, the networkadministration facility 134 may be able to maintain a set of accessrules manually by adding rules, changing rules, deleting rules, or thelike. Additionally, the administration facility 134 may retrievepredefined rule sets from a remote provider of a set of rules to beapplied to an entire enterprise facility 102. The network administrationfacility 134 may be able to modify the predefined rules as needed for aparticular enterprise facility 102 using the network access rulesmanagement facility 124.

When a threat or policy violation is detected by the threat managementfacility 100, the threat management facility 100 may perform or initiatea remedial action facility 128. Remedial action may take a plurality offorms, such as terminating or modifying an ongoing process orinteraction, sending a warning to a client or administration facility134 of an ongoing process or interaction, executing a program orapplication to remediate against a threat or violation, recordinteractions for subsequent evaluation, or the like. Remedial action maybe associated with an application that responds to information that aclient facility network access request has been denied. In animplementation, when the data file is received, remedial action mayparse the data file, interpret the various aspects of the data file, andact on the parsed data file information to determine actions to be takenon an application requesting access to a denied network location. In animplementation, when the data file is received, remedial action mayaccess the threat definitions to parse the data file and determine anaction to be taken on an application requesting access to a deniednetwork location. In an implementation, the information received fromthe facility may be a command or a command file. The remedial actionfacility may carry out any commands that are received or parsed from adata file from the facility without performing any interpretation of thecommands. In an implementation, the remedial action facility mayinteract with the received information and may perform various actionson a client requesting access to a denied network location. The actionmay be one or more of continuing to block all requests to a deniednetwork location, a malicious code scan on the application, a maliciouscode scan on the client facility, quarantine of the application,terminating the application, isolation of the application, isolation ofthe client facility to a location within the network that restrictsnetwork access, blocking a network access port from a client facility,reporting the application to an administration facility 134, or thelike.

Remedial action may be provided as a result of a detection of a threator violation. The detection techniques facility 130 may includemonitoring the enterprise facility 102 network or endpoint devices, suchas by monitoring streaming data through the gateway, across the network,through routers and hubs, and the like. The detection techniquesfacility 130 may include monitoring activity and stored files oncomputing facilities, such as on server facilities 142, desktopcomputers, laptop computers, other mobile computing devices, and thelike. Detection techniques, such as scanning a computer's stored files,may provide the capability of checking files for stored threats, eitherin the active or passive state. Detection techniques, such as streamingfile management, may provide the capability of checking files receivedat the network, gateway facility, client facility, and the like. Thismay provide the capability of not allowing a streaming file or portionsof the streaming file containing malicious code from entering the clientfacility, gateway facility, or network. In an implementation, thestreaming file may be broken into blocks of information, and a pluralityof virus identities may be used to check each of the blocks ofinformation for malicious code. In an implementation, any blocks thatare not determined to be clear of malicious code may not be delivered tothe client facility, gateway facility, or network.

Verifying that the threat management facility 100 is detecting threatsand violations to established policy, may require the ability to testthe system, either at the system level or for a particular computingcomponent. The testing facility 118 may allow the administrationfacility 134 to coordinate the testing of the security configurations ofclient facility computing facilities on a network. The administrationfacility 134 may be able to send test files to a set of client facilitycomputing facilities to test the ability of the client facility todetermine acceptability of the test file. After the test file has beentransmitted, a recording facility may record the actions taken by theclient facility in reaction to the test file. The recording facility mayaggregate the testing information from the client facility and reportthe testing information to the administration facility 134. Theadministration facility 134 may be able to determine the level ofpreparedness of the client facility computing facilities by the reportedinformation. Remedial action may be taken for any of the client facilitycomputing facilities as determined by the administration facility 134;remedial action may be taken by the administration facility 134 or bythe user of the client facility.

The threat research facility 132 may provide a continuously ongoingeffort to maintain the threat protection capabilities of the threatmanagement facility 100 in light of continuous generation of new orevolved forms of malware. Threat research may include researchers andanalysts working on known and emerging malware, such as viruses,rootkits a spyware, as well as other computer threats such as phishing,spam, scams, and the like. In implementations, through threat research,the threat management facility 100 may be able to provide swift, globalresponses to the latest threats.

The threat management facility 100 may provide threat protection to theenterprise facility 102, where the enterprise facility 102 may include aplurality of networked components, such as client facility, serverfacility 142, administration facility 134, firewall 138, gateway, hubsand routers 148, threat management appliance 140, desktop users, mobileusers, and the like. In implementations, it may be the endpoint computersecurity facility 152, located on a computer's desktop, which mayprovide threat protection to a user, and associated enterprise facility102. In implementations, the term endpoint may refer to a computersystem that may source data, receive data, evaluate data, buffer data,or the like (such as a user's desktop computer as an endpoint computer),a firewall as a data evaluation endpoint computer system, a laptop as amobile endpoint computer, a personal digital assistant or tablet as ahand-held endpoint computer, a mobile phone as an endpoint computer, orthe like. In implementations, endpoint may refer to a source ordestination for data, including such components where the destination ischaracterized by an evaluation point for data, and where the data may besent to a subsequent destination after evaluation. The endpoint computersecurity facility 152 may be an application loaded onto the computerplatform or computer support component, where the application mayaccommodate the plurality of computer platforms and/or functionalrequirements of the component. For instance, a client facility computermay be one of a plurality of computer platforms, such as Windows,Macintosh, Linux, and the like, where the endpoint computer securityfacility 152 may be adapted to the specific platform, while maintaininga uniform product and product services across platforms. Additionally,components may have different functions to serve within the enterprisefacility's 102 networked computer-based infrastructure. For instance,computer support components provided as hubs and routers 148, serverfacility 142, firewalls 138, and the like, may require unique securityapplication software to protect their portion of the systeminfrastructure, while providing an element in an integrated threatmanagement system that extends out beyond the threat management facility100 to incorporate all computer resources under its protection.

The enterprise facility 102 may include a plurality of client facilitycomputing platforms on which the endpoint computer security facility 152is adapted. A client facility computing platform may be a computersystem that is able to access a service on another computer, such as aserver facility 142, via a network. This client facility server facility142 model may apply to a plurality of networked applications, such as aclient facility connecting to an enterprise facility 102 applicationserver facility 142, a web browser client facility connecting to a webserver facility 142, an e-mail client facility retrieving e-mail from anInternet 154 service provider's mail storage servers 142, and the like.In implementations, traditional large client facility applications maybe switched to websites, which may increase the browser's role as aclient facility. Clients 144 may be classified as a function of theextent to which they perform their own processing. For instance, clientfacilities are sometimes classified as a fat client facility or thinclient facility. The fat client facility, also known as a thick clientfacility or rich client facility, may be a client facility that performsthe bulk of data processing operations itself, and does not necessarilyrely on the server facility 142. The fat client facility may be mostcommon in the form of a personal computer, where the personal computermay operate independent of any server facility 142. Programmingenvironments for fat clients 144 may include CURT, Delphi, Droplets,Java, win32, X11, and the like. Thin clients 144 may offer minimalprocessing capabilities, for instance, the thin client facility mayprimarily provide a graphical user interface provided by an applicationserver facility 142, which may perform the bulk of any required dataprocessing. Programming environments for thin clients 144 may includeJavaScript/AJAX, ASP, JSP, Ruby on Rails, Python's Django, PHP, and thelike. The client facility may also be a mix of the two, such asprocessing data locally, but relying on a server facility 142 for datastorage. As a result, this hybrid client facility may provide benefitsfrom both the fat client facility type, such as multimedia support andhigh performance, and the thin client facility type, such as highmanageability and flexibility. In implementations, the threat managementfacility 100, and associated endpoint computer security facility 152,may provide seamless threat protection to the plurality of clients 144,and client facility types, across the enterprise facility 102.

The enterprise facility 102 may include a plurality of server facilities142, such as application servers, communications servers, file servers,database servers, proxy servers, mail servers, fax servers, gameservers, web servers, and the like. A server facility 142, which mayalso be referred to as a server facility 142 application, serverfacility 142 operating system, server facility 142 computer, or thelike, may be an application program or operating system that acceptsclient facility connections in order to service requests from clients144. The server facility 142 application may run on the same computer asthe client facility using it, or the server facility 142 and the clientfacility may be running on different computers and communicating acrossthe network. Server facility 142 applications may be divided amongserver facility 142 computers, with the dividing depending upon theworkload. For instance, under light load conditions all server facility142 applications may run on a single computer and under heavy loadconditions a single server facility 142 application may run on multiplecomputers. In implementations, the threat management facility 100 mayprovide threat protection to server facilities 142 within the enterprisefacility 102 as load conditions and application changes are made.

A server facility 142 may also be an appliance facility 140, where theappliance facility 140 provides specific services onto the network.Though the appliance facility 140 is a server facility 142 computer,that may be loaded with a server facility 142 operating system andserver facility 142 application, the enterprise facility 102 user maynot need to configure it, as the configuration may have been performedby a third party. In an implementation, an enterprise facility 102appliance may be a server facility 142 appliance that has beenconfigured and adapted for use with the threat management facility 100,and located within the facilities of the enterprise facility 102. Theenterprise facility's 102 threat management appliance may enable theenterprise facility 102 to administer an on-site local managed threatprotection configuration, where the administration facility 134 mayaccess the threat resources through an interface, such as a web portal.In an alternate implementation, the enterprise facility 102 may bemanaged remotely from a third party, vendor, or the like, without anappliance facility 140 located within the enterprise facility 102. Inthis instance, the appliance functionality may be a shared hardwareproduct between pluralities of enterprises 102. In implementations, theappliance facility 140 may be located at the enterprise facility 102,where the enterprise facility 102 maintains a degree of control. Inimplementations, a hosted service may be provided, where the appliance140 may still be an on-site black box to the enterprise facility 102,physically placed there because of infrastructure requirements, butmanaged by a third party, vendor, or the like.

Simple server facility 142 appliances may also be utilized across theenterprise facility's 102 network infrastructure, such as switches,routers, wireless routers, hubs and routers, gateways, print servers,net modems, and the like. These simple server facility appliances maynot require configuration by the enterprise facility 102, but mayrequire protection from threats via an endpoint computer securityfacility 152. These appliances may provide interconnection serviceswithin the enterprise facility 102 network, and therefore may advancethe spread of a threat if not properly protected.

A client facility may be protected from threats from within theenterprise facility 102 network using a personal firewall, which may bea hardware firewall, software firewall, or combination of these, thatcontrols network traffic to and from a client. The personal firewall maypermit or deny communications based on a security policy. Personalfirewalls may be designed for use by end-users, which may result inprotection for only the computer on which it's installed. Personalfirewalls may be able to control network traffic by providing promptseach time a connection is attempted and adapting security policyaccordingly. Personal firewalls may also provide some level of intrusiondetection, which may allow the software to terminate or blockconnectivity where it suspects an intrusion is being attempted. Otherfeatures that may be provided by a personal firewall may include alertsabout outgoing connection attempts, control of program access tonetworks, hiding the client from port scans by not responding tounsolicited network traffic, monitoring of applications that may belistening for incoming connections, monitoring and regulation ofincoming and outgoing network traffic, prevention of unwanted networktraffic from installed applications, reporting applications that makeconnection attempts, reporting destination servers with whichapplications may be attempting communications, and the like. Inimplementations, the personal firewall may be provided by the threatmanagement facility 100.

Another important component that may be protected by an endpointcomputer security facility 152 is a network firewall facility 138, whichmay be a hardware or software device that may be configured to permit,deny, or proxy data through a computer network that has different levelsof trust in its source of data. For instance, an internal enterprisefacility 102 network may have a high level of trust, because the sourceof all data has been sourced from within the enterprise facility 102. Anexample of a low level of trust is the Internet 154, because the sourceof data may be unknown. A zone with an intermediate trust level,situated between the Internet 154 and a trusted internal network, may bereferred to as a “perimeter network.” Since firewall facilities 138represent boundaries between threat levels, the endpoint computersecurity facility 152 associated with the firewall facility 138 mayprovide resources that may control the flow of threats at thisenterprise facility 102 network entry point. Firewall facilities 138,and associated endpoint computer security facility 152, may also beassociated with a network node that may be equipped for interfacingbetween networks that use different protocols. In implementations, theendpoint computer security facility 152 may provide threat protection ina plurality of network infrastructure locations, such as at theenterprise facility 102 network entry point, i.e. the firewall facility138 or gateway; at the server facility 142; at distribution pointswithin the network, i.e. the hubs and routers 148; at the desktop ofclient facility computers; and the like. In implementations, the mosteffective location for threat detection may be at the user's computerdesktop endpoint computer security facility 152.

The interface between the threat management facility 100 and theenterprise facility 102, and through the appliance facility 140 toembedded endpoint computer security facilities, may include a set oftools that may be the same for all enterprise implementations, but alloweach enterprise to implement different controls. In implementations,these controls may include both automatic actions and managed actions.Automatic actions may include downloads of the endpoint computersecurity facility 152 to components of the enterprise facility 102,downloads of updates to existing endpoint computer security facilitiesof the enterprise facility 102, uploaded network interaction requestsfrom enterprise facility 102 components to the threat managementfacility 100, and the like. In implementations, automatic interactionsbetween the enterprise facility 102 and the threat management facility100 may be configured by the threat management facility 100 and anadministration facility 134 in the enterprise facility 102. Theadministration facility 134 may configure policy rules that determineinteractions, such as developing rules for accessing applications, as inwho is authorized and when applications may be used; establishing rulesfor ethical behavior and activities; rules governing the use ofentertainment software such as games, or personal use software such asIM and VoIP; rules for determining access to enterprise facility 102computing resources, including authentication, levels of access, riskassessment, and usage history tracking; rules for when an action is notallowed, such as whether an action is completely deigned or justmodified in its execution; and the like. The administration facility 134may also establish license management, which in turn may furtherdetermine interactions associated with a licensed application. Inimplementations, interactions between the threat management facility 100and the enterprise facility 102 may provide threat protection to theenterprise facility 102 by managing the flow of network data into andout of the enterprise facility 102 through automatic actions that may beconfigured by the threat management facility 100 or the administrationfacility 134.

Client facilities within the enterprise facility 102 may be connected tothe enterprise facility 102 network by way of wired network facilities148A or wireless network facilities 148B. Client facilities connected tothe enterprise facility 102 network via a wired facility 148A orwireless facility 148B may receive similar protection, as bothconnection types are ultimately connected to the same enterprisefacility 102 network, with the same endpoint computer security facility152, and the same threat protected enterprise facility 102 environment.Mobile wireless facility clients 144B-F, because of their ability toconnect to any wireless 148B,D network access point, may connect to theInternet 154 outside the enterprise facility 102, and therefore outsidethe threat-protected environment of the enterprise facility 102. In thisinstance the mobile client facility (e.g., the clients 144 B-F), if notfor the presence of the endpoint computer security facility 152 mayexperience a malware attack or perform actions counter to enterprisefacility 102 established policies. In addition, there may be a pluralityof ways for the threat management facility 100 to protect theout-of-enterprise facility 102 mobile client facility (e.g., the clients144 D-F) that has an embedded endpoint computer security facility 152,such as by providing URI filtering in personal routers, using a webappliance as a DNS proxy, or the like. Mobile client facilities that arecomponents of the enterprise facility 102 but temporarily outsideconnectivity with the enterprise facility 102 network may be providedwith the same threat protection and policy control as client facilitiesinside the enterprise facility 102. In addition, mobile the clientfacilities may receive the same interactions to and from the threatmanagement facility 100 as client facilities inside the enterprisefacility 102, where the mobile client facilities may be considered avirtual extension of the enterprise facility 102, receiving all the sameservices via their embedded endpoint computer security facility 152.

Interactions between the threat management facility 100 and thecomponents of the enterprise facility 102, including mobile clientfacility extensions of the enterprise facility 102, may ultimately beconnected through the Internet 154. Threat management facility 100downloads and upgrades to the enterprise facility 102 may be passed fromthe firewalled networks of the threat management facility 100 through tothe endpoint computer security facility 152 equipped components of theenterprise facility 102. In turn the endpoint computer security facility152 components of the enterprise facility 102 may upload policy andaccess requests back across the Internet 154 and through to the threatmanagement facility 100. The Internet 154 however, is also the paththrough which threats may be transmitted from their source. Thesenetwork threats 104 may include threats from a plurality of sources,including without limitation, websites, e-mail, IM, VoIP, applicationsoftware, and the like. These threats may attempt to attack a mobileenterprise client facility (e.g., the clients 144B-F) equipped with anendpoint computer security facility 152, but in implementations, as longas the mobile client facility is embedded with an endpoint computersecurity facility 152, as described above, threats may have no bettersuccess than if the mobile client facility were inside the enterprisefacility 102.

However, if the mobile client facility were to attempt to connect intoan unprotected connection point, such as at a secondary location 108that is not a part of the enterprise facility 102, the mobile clientfacility may be required to request network interactions through thethreat management facility 100, where contacting the threat managementfacility 100 may be performed prior to any other network action. Inimplementations, the client facility's 144 endpoint computer securityfacility 152 may manage actions in unprotected network environments suchas when the client facility (e.g., client 144F) is in a secondarylocation 108 or connecting wirelessly to a non-enterprise facility 102wireless Internet connection, where the endpoint computer securityfacility 152 may dictate what actions are allowed, blocked, modified, orthe like. For instance, if the client facility's 144 endpoint computersecurity facility 152 is unable to establish a secured connection to thethreat management facility 100, the endpoint computer security facility152 may inform the user of such, and recommend that the connection notbe made. In the instance when the user chooses to connect despite therecommendation, the endpoint computer security facility 152 may performspecific actions during or after the unprotected connection is made,including running scans during the connection period, running scansafter the connection is terminated, storing interactions for subsequentthreat and policy evaluation, contacting the threat management facility100 upon first instance of a secured connection for further actions andor scanning, restricting access to network and local resources, or thelike. In implementations, the endpoint computer security facility 152may perform specific actions to remediate possible threat incursions orpolicy violations during or after the unprotected connection.

The secondary location 108 may have no endpoint computer securityfacilities 152 as a part of its computer components, such as itsfirewalls 138B, servers 142B, clients 144G, hubs and routers 148C-D, andthe like. As a result, the computer components of the secondary location108 may be open to threat attacks, and become potential sources ofthreats, as well as any mobile enterprise facility clients 144B-F thatmay be connected to the secondary location's 108 network. In thisinstance, these computer components may now unknowingly spread a threatto other components connected to the network.

Some threats may not come directly from the Internet 154, such as fromnon-enterprise facility controlled mobile devices that are physicallybrought into the enterprise facility 102 and connected to the enterprisefacility 102 client facilities. The connection may be made from directconnection with the enterprise facility's 102 client facility, such asthrough a USB port, or in physical proximity with the enterprisefacility's 102 client facility such that a wireless facility connectioncan be established, such as through a Bluetooth connection. Thesephysical proximity threats 110 may be another mobile computing device, aportable memory storage device, a mobile communications device, or thelike, such as CDs and DVDs, memory sticks, flash drives, external harddrives, cell phones, PDAs, MP3 players, digital cameras, point-to-pointdevices, digital picture frames, digital pens, navigation devices,tablets, appliances, and the like. A physical proximity threat 110 mayhave been previously infiltrated by network threats while connected toan unprotected network connection outside the enterprise facility 102,and when connected to the enterprise facility 102 client facility, posea threat. Because of their mobile nature, physical proximity threats 110may infiltrate computing resources in any location, such as beingphysically brought into the enterprise facility 102 site, connected toan enterprise facility 102 client facility while that client facility ismobile, plugged into an unprotected client facility at a secondarylocation 108, and the like. A mobile device, once connected to anunprotected computer resource, may become a physical proximity threat110. In implementations, the endpoint computer security facility 152 mayprovide enterprise facility 102 computing resources with threatprotection against physical proximity threats 110, for instance, throughscanning the device prior to allowing data transfers, through securityvalidation certificates, through establishing a safe zone within theenterprise facility 102 computing resource to transfer data into forevaluation, and the like.

Having provided an overall context for threat detection, the descriptionnow turns to a brief discussion of an example of a computer system thatmay be used for any of the entities and facilities described above.

FIG. 2 illustrates a computer system. In general, the computer system200 may include a computing device 210 connected to a network 202, e.g.,through an external device 204. The computing device 210 may be orinclude any type of network endpoint or endpoints as described herein,e.g., with reference to FIG. 1 above. For example, the computing device210 may include a desktop computer workstation. The computing device 210may also or instead be any suitable device that has processes andcommunicates over a network 202, including without limitation a laptopcomputer, a desktop computer, a personal digital assistant, a tablet, amobile phone, a television, a set top box, a wearable computer (e.g.,watch, jewelry, or clothing), a home device (e.g., a thermostat or ahome appliance controller), just as some examples. The computing device210 may also or instead include a server, or it may be disposed on aserver.

The computing device 210 may be used for any of the entities describedin the threat management environment described above with reference toFIG. 1. For example, the computing device 210 may be a server, a clientan enterprise facility, a threat management facility, or any of theother facilities or computing devices described therein. In certainaspects, the computing device 210 may be implemented using hardware or acombination of software and hardware, and the computing device 210 maybe a standalone device, a device integrated into another entity ordevice, a platform distributed across multiple entities, or avirtualized device executing in a virtualization environment.

The network 202 may include any network described above, e.g., datanetwork(s) or internetwork(s) suitable for communicating data andcontrol information among participants in the computer system 200. Thismay include public networks such as the Internet, private networks, andtelecommunications networks such as the Public Switched TelephoneNetwork or cellular networks using third generation cellular technology(e.g., 3G or IMT-2000), fourth generation cellular technology (e.g., 4G,LTE. MT-Advanced, E-UTRA, etc.) or WiMax-Advanced (IEEE 802.16m)) and/orother technologies, as well as any of a variety of corporate area,metropolitan area, campus or other local area networks or enterprisenetworks, along with any switches, routers, hubs, gateways, and the likethat might be used to carry data among participants in the computersystem 200. The network 202 may also include a combination of datanetworks, and need not be limited to a strictly public or privatenetwork.

The external device 204 may be any computer or other remote resourcethat connects to the computing device 210 through the network 202. Thismay include threat management resources such as any of thosecontemplated above, gateways or other network devices, remote servers orthe like containing content requested by the computing device 210, anetwork storage device or resource, a device hosting malicious content,or any other resource or device that might connect to the computingdevice 210 through the network 202.

The computing device 210 may include a processor 212, a memory 214, anetwork interface 216, a data store 218, and one or more input/outputdevices 220. The computing device 210 may further include or be incommunication with peripherals 222 and other external input/outputdevices 224.

The processor 212 may be any as described herein, and in general becapable of processing instructions for execution within the computingdevice 210 or computer system 200. The processor 212 may include asingle-threaded processor or a multi-threaded processor. The processor212 may be capable of processing instructions stored in the memory 214or on the data store 218.

The memory 214 may store information within the computing device 210 orcomputer system 200. The memory 214 may include any volatile ornon-volatile memory or other computer-readable medium, including withoutlimitation a Random Access Memory (RAM), a flash memory, a Read OnlyMemory (ROM), a Programmable Read-only Memory (PROM), an Erasable PROM(EPROM), registers, and so forth. The memory 214 may store programinstructions, program data, executables, and other software and datauseful for controlling operation of the computing device 200 andconfiguring the computing device 200 to perform functions for a user.The memory 214 may include a number of different stages and types fordifferent aspects of operation of the computing device 210. For example,a processor may include on-board memory and/or cache for faster accessto certain data or instructions, and a separate, main memory or the likemay be included to expand memory capacity as desired.

The memory 214 may, in general, include a non-volatile computer readablemedium containing computer code that, when executed by the computingdevice 200 creates an execution environment for a computer program inquestion, e.g., code that constitutes processor firmware, a protocolstack, a database management system, an operating system, or acombination of the foregoing, and that performs some or all of the stepsset forth in the various flow charts and other algorithmic descriptionsset forth herein. While a single memory 214 is depicted, it will beunderstood that any number of memories may be usefully incorporated intothe computing device 210. For example, a first memory may providenon-volatile storage such as a disk drive for permanent or long-termstorage of files and code even when the computing device 210 is powereddown. A second memory such as a random access memory may providevolatile (but higher speed) memory for storing instructions and data forexecuting processes. A third memory may be used to improve performanceby providing even higher speed memory physically adjacent to theprocessor 212 for registers, caching and so forth.

The network interface 216 may include any hardware and/or software forconnecting the computing device 210 in a communicating relationship withother resources through the network 202. This may include remoteresources accessible through the Internet, as well as local resourcesavailable using short range communications protocols using, e.g.,physical connections (e.g., Ethernet), radio frequency communications(e.g., WiFi), optical communications, (e.g., fiber optics, infrared, orthe like), ultrasonic communications, or any combination of these orother media that might be used to carry data between the computingdevice 210 and other devices. The network interface 216 may, forexample, include a router, a modem, a network card, an infraredtransceiver, a radio frequency (RF) transceiver, a near fieldcommunications interface, a radio-frequency identification (RFID) tagreader, or any other data reading or writing resource or the like.

More generally, the network interface 216 may include any combination ofhardware and software suitable for coupling the components of thecomputing device 210 to other computing or communications resources. Byway of example and not limitation, this may include electronics for awired or wireless Ethernet connection operating according to the IEEE802.11 standard (or any variation thereof), or any other short or longrange wireless networking components or the like. This may includehardware for short range data communications such as Bluetooth or aninfrared transceiver, which may be used to couple to other localdevices, or to connect to a local area network or the like that is inturn coupled to a data network 202 such as the Internet. This may alsoor instead include hardware/software for a WiMax connection or acellular network connection (using, e.g., CDMA, GSM, LTE, or any othersuitable protocol or combination of protocols). The network interface216 may be included as part of the input/output devices 220 orvice-versa.

The data store 218 may be any internal memory store providing acomputer-readable medium such as a disk drive, an optical drive, amagnetic drive, a flash drive, or other device capable of providing massstorage for the computing device 210. The data store 218 may storecomputer readable instructions, data structures, program modules, andother data for the computing device 210 or computer system 200 in anon-volatile form for subsequent retrieval and use. For example, thedata store 218 may store without limitation one or more of the operatingsystem, application programs, program data, databases, files, and otherprogram modules or other software objects and the like.

The input/output interface 220 may support input from and output toother devices that might couple to the computing device 210. This may,for example, include serial ports (e.g., RS-232 ports), universal serialbus (USB) ports, optical ports, Ethernet ports, telephone ports, audiojacks, component audio/video inputs, HDMI ports, and so forth, any ofwhich might be used to form wired connections to other local devices.This may also or instead include an infrared interface, RF interface,magnetic card reader, or other input/output system for coupling in acommunicating relationship with other local devices. It will beunderstood that, while the network interface 216 for networkcommunications is described separately from the input/output interface220 for local device communications, these two interfaces may be thesame, or may share functionality, such as where a USB port is used toattach to a WiFi accessory, or where an Ethernet connection is used tocouple to a local network attached storage.

A peripheral 222 may include any device used to provide information toor receive information from the computing device 200. This may includehuman input/output (I/O) devices such as a keyboard, a mouse, a mousepad, a track ball, a joystick, a microphone, a foot pedal, a camera, atouch screen, a scanner, or other device that might be employed by theuser 230 to provide input to the computing device 210. This may also orinstead include a display, a speaker, a printer, a projector, a headsetor any other audiovisual device for presenting information to a user.The peripheral 222 may also or instead include a digital signalprocessing device, an actuator, or other device to support control orcommunication to other devices or components. Other I/O devices suitablefor use as a peripheral 222 include haptic devices, three-dimensionalrendering systems, augmented-reality displays, and so forth. In oneaspect, the peripheral 222 may serve as the network interface 216, suchas with a USB device configured to provide communications via shortrange (e.g., Bluetooth, WiFi, Infrared, RF, or the like) or long range(e.g., cellular data or WiMax) communications protocols. In anotheraspect, the peripheral 222 may provide a device to augment operation ofthe computing device 210, such as a global positioning system (GPS)device, a security dongle, or the like. In another aspect, theperipheral may be a storage device such as a flash card, USB drive, orother solid state device, or an optical drive, a magnetic drive, a diskdrive, or other device or combination of devices suitable for bulkstorage. More generally, any device or combination of devices suitablefor use with the computing device 200 may be used as a peripheral 222 ascontemplated herein.

Other hardware 226 may be incorporated into the computing device 200such as a co-processor, a digital signal processing system, a mathco-processor, a graphics engine, a video driver, and so forth. The otherhardware 226 may also or instead include expanded input/output ports,extra memory, additional drives (e.g., a DVD drive or other accessory),and so forth.

A bus 232 or combination of busses may serve as an electromechanicalplatform for interconnecting components of the computing device 200 suchas the processor 212, memory 214, network interface 216, other hardware226, data store 218, and input/output interface. As shown in FIG. 2,each of the components of the computing device 210 may be interconnectedusing a system bus 232 or other communication mechanism forcommunicating information.

Methods and systems described herein can be realized using the processor212 of the computer system 200 to execute one or more sequences ofinstructions contained in the memory 214 to perform predetermined tasks.In implementations, the computing device 200 may be deployed as a numberof parallel processors synchronized to execute code together forimproved performance, or the computing device 200 may be realized in avirtualized environment where software on a hypervisor or othervirtualization management facility emulates components of the computingdevice 200 as appropriate to reproduce some or all of the functions of ahardware instantiation of the computing device 200.

FIG. 3 illustrates a threat management system using heartbeats. Ingeneral, a system 600 may include an endpoint 602, a gateway 604, athreat management system 606, and a management system 608 that managesother elements including the endpoint 602, the gateway 604, and one ormore additional endpoints 610. Each of these components may beconfigured with suitable programming to participate in the detection andremediation of an advanced persistent threat (APT) or other malwarethreat as contemplated herein.

The endpoint 602 may be any of the endpoints described herein, or anyother device or network asset that might join or participate in anenterprise network. The endpoint 602 may contain a threat 612 such as anadvanced persistent threat, virus, or similar malware that resides onthe endpoint 602. The threat 612 may have reached the endpoint 602 in avariety of ways, and may have been placed manually or automatically onthe endpoint 602 by a malicious source. It will be understood that thethreat 612 may take any number of forms and have any number ofcomponents. For example, the threat 612 may include an executable filethat can execute independently, or the threat 612 may be a macro,plug-in, or the like that executes within another application.Similarly, the threat 612 may manifest as one or more processes orthreads executing on the endpoint 602. The threat 612 may install from afile on the endpoint 602 or a file remote from the endpoint 602, and thethreat 612 may create one or more other files such as data files or thelike while executing. Advanced persistent threats can be particularlydifficult to detect and remediate, and the systems and methodscontemplated herein can advantageously provide improved sensitivity tosuch threats, as well as enabling improved remediation strategies.However, the systems and methods contemplated herein may also or insteadbe used to detect and remediate other types of malware threats. As such,in this context references to a particular type of threat (e.g., anadvanced persistent threat) should be understood to generally includeany type of malware or other threat to an endpoint or network unless amore specific threat or threat type is explicitly provided or otherwiseclear from the context.

The threat 612 may be analyzed by one or more threat countermeasures onthe endpoint 602 such as a whitelisting filter 614 that approves eachitem of code before executing on the endpoint 602 and prevents executionof non-whitelisted code. The endpoint 602 may also include an antivirusengine 616 or other malware detection software that uses any of avariety of techniques to identify malicious code by reputation or othercharacteristics. A runtime detection engine 618 may also monitorexecuting code to identify possible threats. More generally, any of avariety of threat detection techniques may be applied to the threat 612before and during execution. In general, a threat 612 may evade theseand other security measures and begin executing as a process 620 on theendpoint 602.

Network traffic 622 from the process 620 may be monitored and logged bya traffic monitor 624 on the endpoint 602. The traffic monitor 624 may,for example, log a time and a source of each network request from theendpoint 602. Where the endpoint 602 is within an enterprise network,the network traffic 622 may pass through the gateway 604 in transit to adata network such as the Internet. While the gateway 604 may belogically or physically positioned between the endpoint 602 and anexternal data network, it will be understood that other configurationsare possible. For example, where the endpoint 602 is associated with anenterprise network but operating remotely, the endpoint 602 may form aVPN or other secure tunnel or the like to the gateway 604 for use of athreat management system 606, enterprise management system 608, and anyother enterprise resources.

The endpoint 602 may use a heartbeat 626 to periodically and securelycommunicate status to the gateway 604. The heartbeat 626 may be createdby a security routine, which may be or may include health monitor 628within the endpoint 602, and may be transmitted to a remote healthmonitor 630 at the gateway 604. The health monitor 628 may monitorsystem health in a variety of ways, such as by checking the status ofindividual software items executing on the endpoint 602, checking thatantivirus and other security software is up to date (e.g., with currentvirus definition files and so forth) and running correctly, checking theintegrity of cryptographic key stores, checking for compliance withenterprise security policies, and checking any other hardware orsoftware components of the endpoint 602 as necessary or helpful forhealth monitoring. The health monitor 628 may thus condition theissuance of a heartbeat 626 on a satisfactory status of the endpoint 602according to any suitable criteria, enterprise polices, and otherevaluation techniques.

The heartbeat 626 may be communicated in any suitable manner of securechannel so that the health monitor 630 can reliably confirm the sourceof the heartbeat 626 and the status of the endpoint 602. To this end,the heartbeat 626 may be communicated in a secure channel, such as achannel that is cryptographically signed or secured using a private keyor a symmetric key shared using a private key, so that the monitor 630can authenticate the origin of the heartbeat 626 using a correspondingpublic key. In one aspect, the heartbeat 626 may include a combinationof plaintext information and encrypted information, such as where thestatus information for the endpoint is provided in plaintext while adigital signature for authentication is cryptographically secured. Inanother aspect, all of the information in the heartbeat 626 may beencrypted.

In one aspect, a key vault 632 may be provided on the endpoint tosupport cryptographic functions associated with a secure heartbeat. Anobfuscated key vault 632 may support numerous useful functions,including without limitation, private key decryption, asymmetricsigning, and validation with a chain of trust to a specific rootvalidation certificate. A variety of suitable key management andcryptographic systems are known in the art and may be usefully employedto a support the use of a secure heartbeat as contemplated herein. Thesystem may support a secure heartbeat in numerous ways. For example, thesystem may ensure that signing and decryption keys can only be used inauthorized ways and inside an intended Access Control mechanism. Thesystem may use “anti-lifting” techniques to ensure that a signing keycan only be used when the endpoint is healthy. The system may ensurethat attacking software cannot, without first reverse-engineering thekey vault 632, extract the original key material. The system may alsousefully ensure that an attacker cannot undetectably replace the publickeys in a root certificate store, either directly or indirectly, such asin an attack that tries to cause the code to validate against adifferent set of root keys without directly replacing any keys in theroot store.

A robust heartbeat 626 may usefully provide defensive mechanisms againstreverse engineering of obfuscated content (e.g., the private keymaterial stored in key vault 632, the code used to validate the correctrunning of the remainder of the systems as part of the heartbeat 626code itself) and any anti-lifting protections to prevent malware fromdirectly using the endpoint 602 (or the health monitor 628 on theendpoint 602) to continue to send out signed heartbeat packets (e.g.stating that “all is well” with the endpoint) after security mechanismshave been impaired, disabled, or otherwise compromised in any way.Lifting in this manner by malicious code can be materially mitigated byproviding statistical validation (e.g., with checksums of code) of callstacks, calling processes, and core processes. Likewise, statisticalchecks as well as checksum integrations into the cryptographiccalculations may protect against code changes in the heartbeat 626 codeitself.

A variety of useful techniques may be employed to improve security ofthe key vault 632 and the heartbeat 626. For example, the system may usedomain shifting so that original key material is inferred based onhardware and software properties readily available to the key vault 632,and to ensure that key material uses non-standard algorithms. Softwareproperties may, for example, include readily determined system valuessuch as hashes of nearby code. In another aspect, the keys may be domainshifted in a manner unique to the endpoint 602 so that the manner ofstatistical validation of call stacks and core software is unique to theendpoint 602. Further the key vault may be provisioned so that a publickey stored in the key vault 632 is signed with a certificate (or into acertificate chain) that can be externally validated by a networkappliance or other trusted third party or directly by the health monitor628 or remote health monitor 630.

The heartbeat 626 may encode any useful status information, and may betransmitted from the endpoint 602 on any desired schedule including anyperiodic, aperiodic, random, deterministic, or other schedule.Configured in this manner, the heartbeat 626 can provide secure,tamper-resistant instrumentation for status of the endpoint 602, and inparticular an indication that the endpoint 602 is online anduncompromised. A delay or disappearance of the heartbeat 626 from theendpoint 602 may indicate that the endpoint 602 has been compromised;however this may also simply indicate that the endpoint 602 has beenpowered off or intentionally disconnected from the network. Thus, othercriteria may be used in addition to the disappearance or interruption ofthe heartbeat 626 to more accurately detect malicious software. Somesuch techniques are described below, but it will be understood that thismay include any supplemental information that might tend to make anattack on the endpoint 602 more or less likely. For example, if theheartbeat 626 is interrupted but the endpoint 602 is still sourcingnetwork traffic, then an inference might suitably be made that theendpoint 602 is compromised.

The threat management system 606 may, in general, be any of the threatmanagement systems described herein. The enterprise management system608 generally provides tools and interfaces for administration of theenterprise and various endpoints 610 and other resources or assetsattached thereto. It will be understood that, the functions of thethreat management system 606 and the enterprise management system 608may vary, and general threat management and administration functions maybe distributed in a variety of ways between and among these and othercomponents. This is generally indicated in FIG. 3 as a threat managementfacility 650 that includes the threat management system 606 and theenterprise management system 608. It will be understood that either orboth of these systems may be administered by third parties on behalf ofthe enterprise, or managed completely within the enterprise, or somecombination of these, all without departing from the scope of thisdisclosure. It will similarly be understood that a reference herein to athreat management facility 650 is not intended to imply any particularcombination of functions or components, and shall only be understood toinclude such functions or components as explicitly stated in aparticular context, or as necessary to provide countermeasures formalware (e.g., advanced persistent threats) as contemplated herein.

FIGS. 4A-D each illustrate a block diagram of an example of a networkingsystem 1000 according to various implementations. These examples showsome ways in which the functionality of different ones of the endpoints1100, WAPs 1300, firewalls 1500 and supervisor 1700 may be configuredrelative to each other. It should be understood that theseconfigurations were selected to be demonstrative and relatively simpleexamples, and that many other implementations are possible that includemore or less endpoints 1100, WAPs 1300, firewalls 1500, supervisors1700, and sites 1600. Functionality of the different components 1100,1300, 1500, and 1700 may be integrated in different ways, and componentsmay be configured in 1, 2, 3, or any number of sites, and maycommunicate over a variety of network configurations.

Turning to FIG. 4A, as depicted, the networking system 1000 mayincorporate one or more endpoints 1100, one or more wireless accesspoints (WAPs) 1300, one or more firewalls 1500, and/or at least onesupervisor 1700. As also depicted, each endpoint 1100 may be coupled toa WAP 1300 via a wireless link 1290. In turn, one or more WAPs 1300 maybe coupled to a firewall 1500 by an intermediate network 1490, forexample, a local area network (LAN). Further, each of the one or morefirewalls 1500 may be coupled to an external network 1690, such as theInternet, through which each of the one or more firewalls maycommunicate with the at least one supervisor 1700.

Various factors may determine how many of the WAPs 1300 and/or firewalls1500 are included in the networking system 1000, such as the geographicarea covered by the networking system 1000, the quantity and/or type ofbuildings and/or other structures in the covered area, and/or thequantity of endpoints 1100 to be supported. In the specific example ofFIG. 4A, the networking system 1000 may cover two sites 1600 a and 1600b that may be separated by a geographic distance, physical barrier, etc.As depicted, such a circumstance may encourage the use of at least onefirewall 1500 at each of the two sites 1600 a and 1600 b to serve asseparate gateways for each of the two sites 1600 a and 1600 b to theexternal network 1690. Also, the supervisor 1700 may be situated at alocation that may be geographically distant from or beyond a physical orother barrier from each of the two sites 1600 a and 1600 b. Further, andthough not specifically depicted, at least one backup WAP 1300 and/orbackup firewall 1500 may be co-located with one or more of the depictedWAPs 1300 and/or firewalls, respectively.

The use of wireless links 1290 established between each of the endpoints1100 and an associated one of the WAPs 1300 may afford a degree ofportability of the endpoints 1100 throughout the depicted sites 1600 aand 1600 b by eliminating the need to physically couple each of theendpoints 1100 to a cable-based network. For reasons of data throughput,as well as security, the intermediate network(s) 1490 coupling each ofthe WAPs 1300 to an associated firewall 1500 may employ electricallyand/or optically conductive cabling. In turn, each of the firewalls 1500may be also be coupled to the external network 1690 by electricallyand/or optically conductive cabling as well as intermediate devices,such as routers and modems.

Each of the firewalls 1500 may serve as a gateway by which each of theendpoints 1100 may access the external network 1690 with the benefit ofsome degree of security provided by an associated one of the firewalls1500. Additionally, various ones of the endpoints 1100 may engage innetwork communications with each other that may remain entirely amongthe endpoints 1100 wirelessly coupled to a single WAP 1300. In someimplementations, network communications among two or more of theendpoints 1100 may extend between WAPs 1300 that are coupled to a singleone of the intermediate networks 1490 such that the external network1690 is not employed. In some implementations, network communicationsamong two or more of the endpoints 1100 may extend across multiple onesof the intermediate networks 1490 that are each associated with adifferent firewall 1500 and may be separated by the external network1690. In some implementations, one or more associated firewalls 1500 maycooperate to establish a secure channel therebetween through theexternal network 1690 to provide some degree of security for networkcommunications. Other scenarios for the manner in which the networkingsystem 1000 may be utilized by the endpoints 1100 are possible.

FIG. 4B depicts an example of a networking system 1000 in which there isa single site 1600, but in which there is a physical barrier or othercircumstance that leads to separation of a single intermediate network1490, such that two firewalls 1500 are used. To enable the networkingsystem 1000 to extend throughout the site 1600, the two depictedfirewalls 1500 may cooperate to establish a secure channel therebetweenthrough the external network 1690, as the external network may not besubject to the circumstance that prevented the extending of theintermediate network 1490 throughout the site 1600. Also depicted inFIG. 4B is an alternate implementation of a WAP, identified as a WAP1301, that serves as an example of the integration of the functionalityof one of the firewalls 1500 with one of the WAPs 1300. In variousimplementations, the WAP 1301 may be part of the firewall 1500 or thefirewall and WAP may be integrated as one device as with a firewall 1500that has wireless networking capability. In some implementations, thesite 1600 may be divided into more than one site, as with sites 1600 aand 1600 b of FIG. 4A. In some implementations, the WAP 1301 maycommunicate with the other WAPs 1300 over the intermediate network 1490.In some implementations, the intermediate networks 1490 may be bridgedover the external network 1690.

FIG. 4C depicts an example networking system 1000 in which firewall 1501includes the functionality of a firewall 1500 and a supervisor 1700.This example networking system 1000 covers two separated sites 1600 aand 1600 b, and the firewall 1500 may communicate with the supervisor1700 through the external network 1690. Again, such communication may beimplemented through a secure channel formed through the external network1690 between the two firewalls 1500.

FIG. 4D depicts a system 1000 that includes an example implementation ofa combined device, identified as a WAP 1302, which includes thefunctionality of a supervisor 1700, a firewall 1500 and a WAP 1300.Again, two sites 1600 a and 1600 b are shown, although these sites maybe combined, and there may be 1, 2, or any number of sites. A firewall1500 associated with the other of the two sites 1600 a and 1600 b maycommunicate with the supervisor 1700 through the external network 1690,or through the intermediate network 1490 if the intermediate network1490 is connected through the external network 1690 or otherwise. Asalso depicted in FIG. 4D, the integrated device 1302 may be furthercoupled to another device into which the functionality of a WAP 1300 anda firewall 1500 are integrated via an intermediate network 1490 suchthat two firewalls 1500 are in use within the site 1600 a. Such use oftwo firewalls 1500 within the site 1600 a may be appropriate in avariety of circumstances such as a need to provide a level of throughputthat could not be accommodated by either one of the firewalls 1500,alone, in which case WAP/firewall 1301 may have another connection (notshown) to the external network 1690.

FIGS. 5A, 5B and 5C depict further aspects of network communications inan example of the networking system 1000. As depicted, each endpoint1100 may incorporate one or more of a processor 1110, a storage 1111,controls 1107, a display 1108, and a wireless interface 1109 w toestablish a wireless link 1290 with a WAP 1300. The storage 1111 maystore one or more of a security routine 1120, an OS 1121, one or moreapplications 1123, and a network driver 1129. It should be noted thatalthough the network driver 1129 is depicted as a component of the OS1121, implementations are possible in which the OS 1121 and the networkdriver 1129 are separate routines, for example, communicating throughdefined interfaces. The security routine 1120, the OS 1121, the one ormore applications 1123, and/or the network driver 1129 may eachincorporate instructions executable by the processor 1110 to implementlogic to perform various functions as disclosed herein. As will bedescribed in greater detail, a portion of the storage 1111 may beallocated or otherwise defined as a secure zone 1112 in which at least aportion of the security routine 1120 may be executed by the processor1110 while protected from interference by any of the other routines1121, 1123 or 1129. It should also be understood that a given endpointmay include a portion of the functionality described or additionalfunctionality. For example, the endpoint may include an additional wiredor wireless network interface (not shown), and additional controls anddisplays, or no controls and displays.

As depicted, each WAP 1300 may incorporate one or more of a processor1310, a storage 1311, a wireless interface 1309 w to establish awireless link 1290 with one or more endpoints 1100, and a networkinterface 1309 n to couple the WAP 1300 to an intermediate network 1490.It should be noted that although the network interface 1309 n and thewireless interface 1309 w are depicted as separate interfaces,implementations are possible in which these interfaces 1309 n and 1309 ware implemented as a single interface. The storage 1311 may store one ormore of a security routine 1320, a routing routine 1321, and a wirelessroutine 1329. The security routine 1320, the routing routine 1321,and/or the wireless routine 1329 may each incorporate instructionsexecutable by the processor 1310 to implement logic to perform variousfunctions as disclosed herein.

As depicted, each firewall 1500 may incorporate one or more of aprocessor 1510, a storage 1511, and one or more network interfaces 1509n to couple the firewall 1500 to an intermediate network 1490 and to theexternal network 1690. Although shown as one network interface 1509 n,there may be any number of network interfaces 1509 n and networks. Thestorage 1511 may store one or more of a firewall routine 1520, and arouting routine 1521 as well as other routines. The firewall routine1520, and/or the routing routine 1521 may each incorporate instructionsexecutable by the processor 1510 to implement logic to perform variousfunctions as disclosed herein. In implementations in which the firewallroutine is integrated with another device, the integrated devices mayshare a common processor 1510, storage 1511, or network interface 1509n, and the firewall routine may be included in the storage of theintegrated device.

In implementations of the networking system 1000 that include asupervisor 1700, as depicted, the supervisor 1700 may incorporate one ormore of a processor 1710, a storage 1711, and a network interface 1709 nto couple the supervisor 1700 to the external network 1690. The storage1711 may store a supervisory routine 1720. The supervisory routine 1720may incorporate instructions executable by the processor 1710 toimplement logic to perform various functions as disclosed herein. Inimplementations in which the supervisor is integrated with anotherdevice, the integrated devices may share a processor 1710, commonstorage 1711, or network interface 1709 n, and the supervisor routine,may be included in the storage of the integrated device.

Referring more specifically to FIG. 5B, in executing the supervisoryroutine 1720, the processor 1710 of the supervisor 1700 may operate thenetwork interface 1709 n to cooperate with at least the one depictedfirewall 1500 to establish a secure channel 1692 therebetween throughthe external network 1690. Correspondingly, in executing the firewallroutine 1520, the processor 1510 of the firewall 1500 may operate thenetwork interface 1509 n to so cooperate with the supervisor 1700 toestablish the secure channel 1692. In some implementations, suchestablishment of the secure channel 1692 may be conditioned on thesuccessful authentication of at least the firewall 1500 by thesupervisor 1700. In some implementations, such authentication may bebased on a verification of security credentials exchanged therebetween.Such exchanged security credentials may include, but are not limited to,one or more cryptographic keys (e.g., public and/or private keys), ahash value, a pseudo-randomly generated value, digitally signed data,etc. In performing such authentication of the firewall 1500, theprocessor 1710 may be caused by the supervisory routine 1720 to refer toa credentials data 1730 that may be stored within the storage 1711. Thecredentials data 1730 may include security credentials and/orinformation required to generate security credentials associated withmany firewalls 1500 and/or different versions of the firewall 1500. Inimplementations in which the firewall 1500 also performs suchauthentication of the supervisor 1700, the processor 1510 may besimilarly caused to refer to a credentials data 1530 that may be storedwithin the storage 1511.

Additionally, in executing the firewall routine 1520, the processor 1510of the firewall 1500 may further operate the network interface 1509 n tocooperate with at least the one depicted WAP 1300 to establish a securechannel 1492 therebetween through the depicted intermediate network1490. Correspondingly, in executing the security routine 1320, theprocessor 1310 of the WAP 1300 may operate the network interface 1309 nto so cooperate with the firewall 1500 to establish the secure channel1492. Not unlike the establishment of the secure channel 1692, suchestablishment of the secure channel 1492 may be conditioned on thesuccessful authentication of at least the WAP 1300 by the firewall 1500.In performing such authentication of the WAP 1300, the processor 1510may be caused by the firewall routine 1520 to again refer to thecredentials data 1530. The credentials data 1530 may include securitycredentials and/or information required to generate security credentialsassociated with many WAPs 1300 and/or different versions of the WAP1300. Additionally, there may also be implementations in which theprocessor 1310 is caused by the security routine 1320 to similarlyperform such authentication of the firewall 1500.

Referring briefly to FIG. 5C, in some implementations, in executing thesupervisory routine 1720, the processor 1710 of the supervisor 1700 mayoperate the network interface 1709 n to cooperate with at least the onedepicted firewall 1500 to establish the secure channel 1692therebetween, and to cooperate with at least the one depicted WAP 1300through the firewall 1500 to establish the secure channel 1492therebetween through the firewall 1500. Thus, there may be a securechannel 1692 that includes traffic from the WAP 1300 and the firewall1500 as depicted in FIG. 5B, or as depicted in FIG. 5C, the securechannel 1492 may be established through both the depicted intermediatenetwork 1490 and the external network 1690, as well as through thefirewall 1500, and the secure channel 1692 may be established throughthe external network 1690. More broadly, FIG. 5C depicts a securechannel 1492 that extends all the way to the supervisor 1700 such thatdata that is securely transmitted therethrough and is not included inother secure channels 1492 and 1692 by the firewall 1500. For example,as depicted in FIG. 5C, the WAP 1300 may communicate securely with thesupervisor 1700 with less dependence on the security status of thefirewall 1500. This may be deemed desirable to provide some degree ofsecurity in those communications in the event that the security of thefirewall 1500 may be compromised.

Still referring to FIG. 5C, in some implementations, the establishmentof both of the secure channels 1492 and 1692 may be conditioned on thesuccessful authentication of at least the firewall 1500 by thesupervisor 1700. In such implementations, the supervisor 1700 maycondition the establishment of the secure channel 1492 on theestablishment of the secure channel 1692, since the establishment of thesecure channel 1692 may be conditioned on the authentication of thefirewall 1500. Presuming the firewall 1500 is authenticated, thesupervisor 1700 may then permit authentication of the WAP 1300 throughthe firewall 1500, and may then establish the secure channel 1492,presuming authentication of the WAP 1300 is successful. Again, suchauthentications may be based on the verification of exchanged securitycredentials. The credentials data 1730 may include security credentialsand/or information required to generate security credentials associatedwith may WAPs 1300 and/or different versions of the WAP 1300, as well assecurity credentials associated with many firewalls 1500 and/ordifferent versions of the firewall 1500. Referring more broadly to FIGS.5A-C, with the secure channels 1492, 1692 established, various pieces ofinformation related to security may be securely exchanged among the WAP1300, the firewall 1500 and/or the supervisor 1700 through correspondingones of the secure channels 1492 and/or 1692. By way of example, theprocessor 1710 of the supervisor 1700 may be caused by further executionof the supervisory routine 1720 to recurringly provide updated versionsof a threats data 1731 to one or more of the firewalls 1500. The threatsdata 1731 may include patterns (which may include signatures or otherdata) that may be used by the processor 1510 of the firewall 1500 toidentify malware or indicia of compromise based, for example, on networktraffic passing through the firewall 1500. In some implementations,threats data 1731 may include information about network addresses suchas historical information, reputation information, etc. In someimplementations, threats data 1731 may include indications of patternsof behavior that are indicative of potential or actual compromise. Theprocessor 1510 of the firewall 1500 may employ such information in thethreats data 1731 to identify potential or actual compromise, and totake remedial action, such as notification of administrators, conductingscans, isolation of compromised devices, and restricting network trafficflows.

In another example of an exchange of information related to securitythrough the secure channels 1492 and/or 1692, the processor 1710 of thesupervisor 1700 may be caused by execution of the supervisory routine1720 to transmit updated versions of one or more routines and/or datarelated to security to the firewall 1500 and/or to the WAP 1300. Forexample, the processor 1710 may be caused to transmit an updated versionof the firewall routine 1520, the routing routine 1521 and/or thecredentials data 1530 to the firewall 1500 via the secure channel 1692to replace an older version thereof. In some implementations, theprocessor 1710 may be caused to transmit an updated version of thesecurity routine 1320, the routing routine 1321 and/or the wirelessroutine 1329 to the firewall 1500 via the secure channel 1692 to berelayed to the WAP 1300 by the firewall 1500 through the secure channel1492.

In another example of an exchange of pieces of information related tosecurity through the secure channels 1492 and/or 1692, the processor1310 of the WAP 1300 may be caused by execution of the security routine1320 to recurringly transmit indications of the security status of theWAP 1300 to the firewall 1500 through the secure channel 1492. In someimplementations, the processor 1510 of the firewall may be caused byexecution of the firewall routine 1520 to analyze such indications toidentify a potential or actual security threat that may compromise thesecurity status of the WAP 1300. In some implementations, the processor1510 of the firewall 1500 may be caused by the firewall routine 1520and/or the routing routine 1521 to route the indications of securitystatus received from the WAP 1300 onward to the supervisor 1700 throughthe secure channel 1692 for such analysis. In some implementations, theprocessor 1510 of the firewall 1500 may be caused to recurringlytransmit indications of the security status of the firewall 1500 to thesupervisor 1700 through the secure channel 1692 for similar analysis.

In some implementations, the secure channels 1492, 1692 also may be usedto communicate network-related information, for example, informationrelated to the performance or configuration, for example of the wirelessinterface 1309 w, with respect to one or more endpoints 1100. Thenetwork information may include without limitation interfaceconfigurations, connection information, routing information, connectionspeeds, parameter settings, signal quality metrics, noise/interferencelevels and performance statistics.

FIGS. 6A, 6B and 6C each illustrate enabling network communications withan implementation of an endpoint 1100. FIG. 6A depicts an implementationin which the WAP 1300 and the firewall 1500 are implemented as separatedevices, and the firewall 1500 authenticates the endpoint 1100. FIG. 6Bdepicts an implementation in which the functionality of the WAP 1300 andthe firewall 1500 are integrated into a single device. FIG. 6C depictsan implementation in which the WAP 1300 and the firewall 1500 areimplemented as separate devices, and the supervisor authenticates theendpoint 1100. It should be understood that these configurations areexamples, and that other configurations may be used in variousimplementations.

Turning to FIG. 6A, in executing the OS 1121 and/or the network driver1129, the processor 1110 may operate the wireless interface 1109 w tocooperate with the depicted WAP 1300 to establish a wireless link 1290therebetween. Correspondingly, in executing the wireless routine 1329,the processor 1310 of the WAP 1300 may operate the wireless interface1309 w to cooperate with the endpoint 1100 to establish the wirelesslink 1290. In some implementations, establishment of the wireless link1290 may be conditioned on the successful authentication of the endpoint1100 to permit the endpoint 1100 to exchange network traffic with theWAP 1300, at all. Authentication may include a verification of theendpoint 1100 as one of a limited number of endpoints 1100 permitted toexchange network traffic with the WAP 1300. In some implementations,authentication may include the processor 1110 being caused by executionof the OS 1121 and/or the network driver 1129 to receive input at thecontrols 1107 and/or operate the display 1108 to provide a userinterface by which an operator of the endpoint 1100 may use the controls1107 to enter a password, provide a fingerprint, etc.

Upon establishment of the wireless link 1290, the endpoint 1100 may beable to communicate with the firewall 1500 through the wireless link1290, the WAP 1300 and the intermediate network 1490. In executing thefirewall routine 1520, the processor 1510 of the firewall 1500 mayoperate the network interface 1509 n to cooperate with the securityroutine 1120 within the endpoint 1100 to establish a secure channel 1292between the security routine 1120 and the firewall 1500.Correspondingly, in executing the security routine 1120, the processor1110 of the endpoint 1100 may operate the wireless interface 1109 w toso cooperate with the firewall 1500 to establish the secure channel1292. Such establishment of the secure channel 1292 may be conditionedon the successful authentication of at least the security routine 1120by the firewall 1500. In some implementations, such authentication maybe based on a verification of security credentials exchangedtherebetween. Such exchanged security credentials may include, but arenot limited to, one or more cryptographic keys (e.g., public and/orprivate keys), a hash value, a pseudo-randomly generated value,digitally signed data, etc. In performing such authentication of thesecurity routine 1120, the processor 1510 of the firewall 1500 may becaused by the firewall routine 1520 to refer to the credentials data1530. The credentials data 1530 may include security credentials and/orinformation required to generate security credentials associated withthe security routines 1120 within many endpoints 1100 and/or differentversions of the security routine 1120. Additionally, there may also beimplementations in which the processor 1110 is caused by the securityroutine 1120 to similarly perform such authentication of the firewall1500.

With the authentication of the security routine 1120 within the endpoint1100, further security credentials may be exchanged with the securityroutine 1120 to enable encryption and/or other protective measures to betaken to enable secure exchanges of information such as securityinformation with the security routine 1120. In some implementations,this is accomplished in a manner that is intended to minimizeinterference from and/or compromise by other routines executed withinthe endpoint 1100. In this way, the secure channel 1292 may effectivelybe extended from the wireless interface 1109 w to the security routine1120. Also, with authentication carried out between the security routine1120 and the firewall routine 1520 through the WAP 1300, the securechannel 1292 may extend through the WAP 1300 and/or through theintermediate network 1490 to the firewall 1500. The processor 1310 ofthe WAP 1300 may be caused by the routing routine 1321 and/or thesecurity routine 1320 to effectively route the secure channel 1292through the WAP 1300 in a manner that may be akin to other exchanges ofnetwork traffic through the WAP 1300. As a result of these measurestaken to cause the secure channel 1292 to extend between the securityroutine 1120 and the firewall 1500 in a manner that avoids undetectedinterference by other routines within each of the endpoint 1100 and theWAP 1300, interference caused by other routines executed within eitherthe endpoint 1100 or the WAP 1300 may be prevented and/or at leastdetected by the security routine 1120 and/or the firewall 1500.

In some implementations, at least a portion of the security routine 1120may be stored and/or executed within a portion of the storage 1111allocated and/or otherwise defined as the secure zone 1112. In variousimplementations, the secure zone 1112 may be based on any of a varietyof mechanisms. In some implementations, the instruction set of theprocessor 1110 may include a subset of instructions useable only by thesecurity routine 1120 or another related routine to cause instantiationand/or maintenance of the secure zone 1112. Such a subset ofinstructions may be operable on the processor 1110 and/or a supportingmemory controller to define one or more ranges of addresses of storagelocations within the storage 1111 to which access by other routines isdenied, or at least greatly limited. In other implementations, theprocessor 1110 may incorporate a processing core reserved for and/orotherwise designated for the execution of a limited variety of routines,such as the security routine 1120, that are rendered inaccessible toroutines executed by any other processing core of the processor 1110. Instill other implementations, the endpoint 1100 may incorporate asecurity controller (not shown) that includes a controller processorseparate from the processor 1110 and a controller storage separate fromthe storage 1111 to create an entirely independent processingenvironment in which the security routine 1120 may be both stored andexecuted. Still other approaches to establishing and/or maintaining thesecure zone 1112, and/or otherwise securing the security routine 1120may be used.

With the secure channel 1292 established, various pieces of informationrelated to security and pieces of information related to networkmanagement may be securely exchanged among the security routine 1120within the endpoint 1100, the WAP 1300, the firewall 1500 and/or thesupervisor 1700 through corresponding ones of the secure channels 1292,1492 and/or 1692. By way of example, and referring back to FIG. 5B, aswell as to FIG. 6A, the processor 1710 of the supervisor 1700 may becaused by further execution of the supervisory routine 1720 torecurringly provide updated versions of the threats data 1731 and/or thesecurity routine 1120 to the security routine 1120 within the endpoint1100. More specifically, the processor 1710 may be caused to transmitsuch updates to the firewall 1500 through the secure channel 1692, wherethey may be routed and retransmitted to the security routine 1120through the secure channel 1292.

Again, the threats data 1731 may include signatures and/or indicationsof patterns of behavior that may be used by the security routine 1120 tocause the processor 1110 to identify potential or actual compromisewithin the endpoint 1100. In some implementations, the threats data 1731may include historical or reputation information for software, data,and/or network addresses. In some implementations, the security routine1120 may cause the processor 1110 to employ such information in thethreats data 1731 to prevent, undo and/or at least mitigate actual orpotential damage caused by actual or potential compromise within theendpoint 1100. Damage may include, and is not limited to, theft and/ordestruction of information stored within the endpoint 1100 and/or withinother devices to which the endpoint 1100 may be coupled, maliciousencryption of information accompanied by extortion demands to pay aransom to once again be given access to that information (e.g., actionsof so-called “ransomware”), takeover of control by a remote device, etc.

In another example of an exchange of pieces of information related tosecurity through at least the secure channel 1292, the processor 1110 ofthe endpoint 1100 (or the separate controller processor, if there isone) may be caused by execution of the security routine 1120 torecurringly transmit indications of its security status to the firewall1500 through the secure channel 1292 (e.g., a form of recurring security“heartbeat” transmission). The security status may include whether anypolicy violations have occurred, indications of potential or actualcompromise, exposure of system elements to potential or actualcompromise, etc. In some implementations, the processor 1510 of thefirewall may be caused by execution of the firewall routine 1520 toanalyze such indications to identify a potential or actual securitythreat that may compromise (or may have already compromised) thesecurity status of the endpoint 1100. The firewall may take remedialaction, including without limitation notification of administrators,network isolation of the endpoint, directing the endpoint to deleteencryption keys, etc. In some implementations, the processor 1510 of thefirewall 1500 may be caused by the firewall routine 1520 and/or therouting routine 1521 to route indications of security status receivedfrom the security routine 1120 onward to the supervisor 1700 through thesecure channel 1692 for analysis.

Turning to FIG. 6B, the combining and/or integration of the WAP 1300 andthe firewall 1500 into a single device or group of devices (e.g., thedepicted example WAP 1301 earlier introduced in FIGS. 4B and 4D) mayeliminate the need for the establishment of the secure channel 1492therebetween, and accordingly, eliminate the need for either or both ofa separate WAP 1300 and a separate firewall 1500 to authenticate theother and/or to analyze the security status of the other. In someimplementations, the firewall routine 1520 is operated as a separateprogram, and so the secure channel 1492 may be necessary, even if notactually communicated over a network. For example, different processesor applications on the WAP 1301 may communicate using a secure channelbetween them, or using a secure channel with the supervisor 1700.

Turning to FIG. 6C, in some implementations, following establishment ofthe wireless link 1290, the endpoint 1100 may be able to communicatewith the supervisor 1700 through the wireless link 1290, the WAP 1300,the depicted intermediate network 1490, the depicted firewall 1500, andthe external network 1690. The supervisor 1700 may cooperate with thesecurity routine 1120 within the endpoint 1100 to establish a securechannel 1292 between the security routine 1120 and the supervisor 1700.Such establishment of the secure channel 1292 may be conditioned on thesuccessful authentication of at least the security routine 1120 by thesupervisor 1700. Again, such authentication may be based on averification of security credentials exchanged therebetween.

Again, with the authentication of the security routine 1120 within theendpoint 1100, further security credentials may be exchanged with thesecurity routine 1120 to enable encryption and/or other protectivemeasures to be taken to enable exchanges of security related informationwith the security routine 1120 without undetected interference from anyother routine executed within the endpoint 1100, the WAP 1300, and/orthe firewall 1500. For example, if a heartbeat from the endpoint is notcommunicated as expected, the supervisor 1700 will treat that as apotential indication of compromise. For example, if a message istampered with, use of encryption or signature technology will make thatevident.

As a result, the secure channel 1292 may effectively be extended fromthe wireless interface 1109 w to the security routine 1120 in a mannerthat does not permit undetected interference from such other routines asthe network driver 1129 and/or the OS 1121. Also, with suchauthentication carried out between the security routine 1120 and thesupervisor 1700, the secure channel 1292 may extend through the WAP1300, the intermediate network 1490, the firewall 1500 and/or throughthe external network 1690 to the supervisor 1700. The processor 1310 ofthe WAP 1300 may be caused by the routing routine 1321 and/or thesecurity routine 1320 to effectively route the secure channel 1292through the WAP 1300 in a manner that may be akin to other exchanges ofnetwork traffic through the WAP 1300. Similarly, the processor 1510 ofthe firewall 1500 may be caused by the routing routine 1521 and/or thefirewall routine 1520 to effectively route the secure channel 1292through the firewall 1500 in a manner that may be akin to otherexchanges of network traffic through the firewall 1500. As a result ofthese measures taken to cause the secure channel 1292 to extend betweenthe security routine 1120 and the supervisor 1700 in a manner thatavoids undetected interference by other routines within each of theendpoint 1100, the WAP 1300 and the firewall 1500, interference causedby other routines executed within the endpoint 1100, the WAP 1300 and/orthe firewall 1500 may be prevented and/or at least detected by thesupervisor 1700.

With the secure channel 1292 established, various pieces of informationrelated to security and network configuration may be securely exchangedbetween the security routine 1120 within the endpoint 1100 and thesupervisor 1700 through the secure channel 1692. By way of example, andreferring back to FIG. 5C, as well as to FIG. 6C, the processor 1710 ofthe supervisor 1700 may be caused by further execution of thesupervisory routine 1720 to recurringly provide updated versions of thethreats data 1731 and/or the security routine 1120 to the securityroutine 1120 within the endpoint 1100 through the secure channel 1292.Also by way of example, the processor 1110 of the endpoint 1100 (or theseparate controller processor, if there is one) may be caused byexecution of the security routine 1120 to recurringly transmitindications of its security status to the supervisor 1700 through thesecure channel 1292 (e.g., a form of recurring security “heartbeat”transmission). In some implementations, the processor 1710 of thesupervisor 1700 may be caused by execution of the supervisory routine1720 to analyze such indications to identify a security threat that maycompromise (or may have already compromised) the security status of theendpoint 1100.

The same secure channel 1292 may then be used for communication ofnetwork information, which may include, without limitation: interfaceconfigurations, connection information, routing information, connectionspeeds, parameter settings, signal quality metrics, noise/interferencelevels and/or performance statistics.

FIG. 7 illustrates, by example, use of one or more of the securechannels formed within an example of the networking system 1000 toadditionally convey communications associated with monitoring and/orcontrolling one or more characteristics of a wireless link. Morespecifically, one or more secure channels may be employed to enablecoordination between devices to improve network performance (e.g., QOS)and/or effect other changes in characteristics of the network within anexample of the network system 1000.

The secure channel 1292 may share the wireless link 1290 establishedbetween the wireless interface 1109 w of the endpoint 1100 and thewireless interface 1309 w of the WAP 1300 with other network traffic.Other network traffic may arise through the execution of the one or moreapplications 1123 (e.g., web browsers, media streaming applications,network file transfer applications, etc.) by the processor 1110, andfrom communication involving other devices (e.g., endpoints) that aresharing the wireless link 1290. For example, other routines that may beexecuted within the endpoint 1100 or other endpoints may engage inexchanges of network traffic through the wireless link 1290. Networkcommunication may be exchanged through the WAP 1300 and/or the firewall1500 to reach the external network 1690 and any of a variety of otherdevices that may be coupled to the wireless link 1290, the intermediatenetwork 1490, and/or the external network 1690, such as cameras,printers, scanners, file servers, connected devices, web servers, emailservers, media streaming servers, etc. (not shown). Again, such othernetwork traffic may be routed through the WAP 1300 by the processor 1310under the control of the routing routine 1321, and may be allowed topass through the firewall 1500 by the processor 1510 under the controlof the firewall routine 1520.

As familiar to those skilled in the art, the quality of service of datanetworks may be determined by network characteristics including withoutlimitation hardware bandwidth, throughput, configuration, protocols,usage patterns, and other factors. In addition, wireless links may beadversely affected by environmental factors, transmission power, range,interference, protocols, and/or other factors. For example, theintroduction and/or removal of sizable metal objects such as metalfurniture (e.g., desks, filing cabinets, etc.) can affect (e.g., block,reflect, or otherwise alter) the transmission and/or reception of radiofrequency (RF) signals on which wireless links may be based. Forexample, other electronic devices that emit RF signals or other forms ofinterference at the same or similar frequencies as wireless links,and/or more generally emit electromagnetic signals with sufficient powermay affect such wireless links. In addition to entirely blocking RFtransmissions such that they are not received, the introduction of suchfactors may also cause shifts in frequency, or reduce signal strengthand/or otherwise degrade the quality of those RF signals. Likewise,lower quality, improperly configured and/or aging components within oneendpoint 1100 may not properly generate the RF signals on which one ormore of the wireless links 1290 may be based such that its RFtransmission to the WAP 1300 may interfere with the RF transmissionsbetween the WAP 1300 and one or more other endpoints 1100. Suchimproperly generated RF signals may include an inaccurately and/orinconsistently generated carrier frequency, spurious changes inamplitude, improper shifts in waveforms, etc. Any one or combination ofthese factors can may introduce difficulty in receiving portions ofcommunications, and in some cases, interference with certain information(e.g., handshakes and/or other portions of a protocol) may repeatedlydelay communication, and/or introduce errors into portions oftransmitted data such that numerous ones of such portions must beretransmitted. Small devices, such as mobile phones, tablets, wearables,and laptops may be moved during transmission which may change theenvironment during such transmission. The overall effect may be aconsiderable slowing in the rate at which data is able to besuccessfully communicated.

Still referring to FIG. 7, following the earlier-described establishmentof the depicted wireless link 1290, in part through execution of thewireless routine 1329, further execution of the wireless routine 1329may cause the processor 1310 of the WAP 1300 to operate the wirelessinterface 1309 w of the WAP 1300 to monitor various characteristics ofthe wireless link 1290. Again, such a characteristic may include(without limitation) a carrier frequency, an amplitude, asignal-to-noise ratio, an aspect of a shape of a waveform, a bandwidth,a separation between frequencies employed by different channels, afrequency shift, a shift in a waveform, a malformed transition in awaveform, a synchronization characteristic, a dropped portion of aprotocol, a data error rate, etc. The processor 1310 may be caused tomonitor various characteristics of the wireless link to identifyinstances in which one of those characteristics falls outside athreshold that may specify a minimum, a maximum and/or some otherlimitation for that one of those characteristics. Such characteristicsmay be associated with one or more aspects of QOS of the wireless link,and accordingly, an instance of such a characteristic falling outside athreshold may be associated with an aspect of QOS falling outside a QOSthreshold such as a minimum rate of data throughput to be maintained, amaximum delay in performing a portion of a protocol not to be exceeded,etc. In response to one or more characteristics of the link fallingoutside a threshold and/or in response to a predicted possibility of oneor more characteristics of the link falling outside a threshold,including where an aspect of the QOS of the wireless link has fallen ispredicted to fall outside a QOS threshold, the processor 1310 of the WAP1300 may derive a change to make in one or more characteristics of thewireless link to improve the QOS of the wireless link. Again, the one ormore characteristics that are found to have fallen outside a thresholdand/or are predict to fall outside a threshold may not coincide with theone or more characteristics to which a change is derived to be effected.Instead the various physical properties of a network link, whether basedon radio frequency (RF) technology, or not, may be relied upon toprovide a relationship among two or more characteristics of the networklink that may be exploited.

More specifically regarding wireless QOS, there may be one or more QOSthresholds that define minimum and/or maximum values for each of suchcharacteristics such that an aspect of the QOS of the wireless link 1290is deemed to have fallen outside a QOS threshold if one of thecharacteristics of the wireless link 1290 violates one of the minimum ormaximum values defined by a QOS threshold. Where one or more of suchaspects of the QOS is deemed to have fallen outside a QOS threshold oris determined to be about to fall outside a QOS threshold, then theprocessor 1310 may be caused by the wireless routine 1329 to derive achange in a setting associated with the wireless link 1290 to bring theassociated one or more characteristics of the wireless link 1290 backwithin the minimum and/or maximum values defined by the QOS thresholds,and thereby improve the QOS of the wireless link 1290. Beyond bringingaspects of the QOS back within one or more QOS thresholds such that thecharacteristics of the wireless link 1290 are back in a proper state,there may be further improvement possible in the QOS that may be definedhow much more the data rate through the wireless link 1290 is able to beincreased.

Where a setting change to improve the QOS of the wireless link 1290 isable to be made entirely within the WAP 1300 without cooperation withany other device to make a corresponding setting change thereat, thenthe processor 1310 may be caused by the wireless routine 1329 to accessthe wireless interface 1309 w to effect such a setting change. There maybe no need for the processor 1310 to transmit any information concerningsuch a change to any other device. For example, the wireless protocolmay permit the WAP 1300 to direct the endpoint 1100 to make changesusing management features of the wireless protocol. For example, thewireless protocol may permit the WAP 300 to announce changes toparticipants in the wireless link 1290, or simply to make the changes.

There may be other situations in which it is useful to have a settingchange to a characteristic of the wireless link 1290 made at theendpoint 1100. Such a change may or may not be in addition to acorresponding change to be made at the WAP 1300 such that there would bechanges made at both ends of the wireless link 1290. For example, it maybe possible to minimize or eliminate perceived impact to the user of theendpoint 1100 by coordinating changes. For example, it may be possibleto make changes that the protocol would not otherwise permit withoutdisconnecting all endpoints 1100. In such situations, the wirelessroutine 1329 may cooperate with the security routine 1320 to cause theprocessor 1310 of the WAP 1300 to transmit a request to the firewall1500 through the secure channel 1492, where the request is to transmit acommand to the security routine 1120 to make the setting changeaffecting the wireless link 1290 at the endpoint 1100. The transmittedrequest may communicate the setting change to be specified in thecommand, or the transmitted request may directly include the command tobe transmitted. In response to receiving the request from the WAP 1300,the processor 1510 of the firewall 1500 may be caused by the firewallroutine 1520 to transmit the command to the security routine 1120 viathe secure channel 1292.

In response to receiving the command, the processor 1110 of the endpoint1100 may be caused by the security routine 1120 to access the wirelessinterface 1109 w to affect the setting change specified in the command.The wireless interface 1109 w may incorporate one or more semiconductorcomponents that incorporate one or more registers that are normallyaccessed and operated by the processor 1110 under the control of thenetwork driver 1129 and/or another similar routine executed to controlvarious aspects of establishing and/or maintaining the wireless link1290. However, as depicted, the security routine 1120 may access suchcomponents of the wireless interface 1109 w in a manner that bypassesthe network driver 1129 and/or other similar routine.

Upon completion of effecting such a setting change at the endpoint 1100,the processor 1110 may be further caused by the security routine 1120 totransmit an indication that the change has been made back to thefirewall 1500 via the secure channel 1292. Upon receiving theindication, the processor 1510 of the firewall 1500 may be caused by thefirewall routine 1520 to retransmit the indication to the WAP 1300 viathe secure channel 1492. In situations where setting changes that affectthe wireless link 1290 needed to be made at both ends of the wirelesslink 1290 in a coordinated manner, the processor 1310 of the WAP 1300may be caused to await the receipt of the indication that the settingchange having been made at the endpoint 1100 before accessing thewireless interface 1309 w to make the corresponding change at the WAP1300.

In some implementations, changes may be made to a wireless link 1290 inorder to improve the performance of the overall network. For example, anendpoint 1100 may be directed to reduce power, or to change to a slowercommunication speed, or to switch to a different channel or WAP 1300,even if the QoS for that endpoint 1100 is acceptable, if the changewould help other endpoints, and the overall network QoS.

Thus, as depicted in FIG. 7, one or both of the secure channels 1292 and1492 may be employed in securely exchanging information related to oneor more characteristics of the network (e.g., to the QOS of the wirelesslink 1290), in addition to being employed in securely exchanginginformation related to security. Correspondingly, the security routine1120 may serve to effect setting changes to maintain and/or improve theperformance of the network (e.g., the QOS of the wireless link 1290), inaddition to acting within the endpoint 1100 and/or in cooperation withat least the firewall 1500 to maintain security, at least within theendpoint 1100. Such use of secure channels and/or routines related tothe provision of security to additionally maintain and/or improveoverall network performance may be deemed desirable to improve overalluser experience, as well as to prevent a security breach that may befacilitated by poor network performance or poor network configuration.The use of the security routine 1120 in this context provides a securechannel for managing network configuration beyond what is possible, forexample, with current wireless protocols (e.g., protocols of one or moreof the 802.11 series of standards promulgated by the Institute ofElectrical and Electronics Engineers of Washington, D.C., USA).

In some implementations, setting changes are made in response to and/orin anticipation of changes to overall network traffic, for example,volume of traffic exchanged through the network and/or one or morenetwork elements, such as the wireless link 1290. The ongoing monitoringof the security status of the endpoint 1100 by the security routine 1120may entail monitoring what applications 1123 and/or what other routinesare executed within the endpoint 1100 at any given time. The processor1110 may be caused by the security routine 1120 to recurringly transmitindications of what applications 1123 and/or what other routines arecurrently being executed, are about to be executed, and/or are about tocease to be executed to the firewall 1500 via the secure channel 1292 aspart of the security related information recurringly transmitted to thefirewall 1500 (e.g., a recurring security “heartbeat” transmission).

In some implementations, the processor 1110 of the endpoint 1100 may becaused to store indications of patterns of network usage of when variousones of the applications 1123 and/or other routines are executed. Thepatterns of network usage may be stored, for example, as pattern data1133 that may be maintained within the storage 1111 of the endpoint1100. For example, such indications may be of observed daily and/orweekly patterns in of when each of various routines are usually start tobe executed and/or cease to be executed. Further, such indications ofpatterns may be stored along with indications of which routines engagein exchanging network traffic through the wireless link 1290 and/or thevolume of such network traffic. For example, the pattern data 1133 mayinclude an observed average amount of data usage by an applicationand/or an indication of maximum data usage in a predetermined timeperiod. Other data about application network usage may be observed andstored as well.

In some implementations, the processor 1110 of the endpoint 1100 may becaused to store indications of patterns of network usage associated witha user of the endpoint 1100. The patterns of network usage may bestored, for example, as the pattern data 1133 that may be maintainedwithin the storage 1111 of the endpoint 1100. For example, suchindications may be of observed daily and/or weekly patterns for thatuser and/or based on applications 1123 in use or typically used by thatuser. Further, such indications of patterns may be stored along withindications of which routines engage in exchanging network trafficthrough the wireless link 1290 and/or the volume of such networktraffic. For example, the pattern data 1133 may include an observedaverage amount of data usage by an application 1123 and/or an indicationof maximum data usage in a predetermined time period. Other data aboutuser and or user-specific application network usage may be observed andstored as well.

The processor 1110 may then be further caused to transmit to thefirewall 1500 indications of anticipated network usage. For example, theprocessor 1110 may communicate an anticipated network usage associatedwith one or more users on the endpoint 1100, and/or aggregate data usageand/or an anticipated maximum network usage based on the applications1123 currently running on the endpoint 1100 and/or anticipated to run onthe endpoint 1100. The processor 1110 may determine the anticipated datausage based on current network usage, current applications 1123 that arerunning, and the pattern data 1133. Anticipated data usage metrics maybe communicated, for example, over the secure channel 1292. Anticipateddata usage metrics may be communicated, for example, as part of aheartbeat security status report, or separate from the heartbeatsecurity status report, for example, as part of a network usage statusreport.

In some implementations, the processor 1110 of the endpoint 1100 maycommunicate information about the applications 1123 that are running onthe endpoint 1100, when a routine is expected to be executed and/or whena routine is expected to cease to be executed. The processor 1510 of thefirewall 1500 may analyze this information and the patterns of networkusage of the applications 1123 to cause the firewall routine 1520 todetermine anticipated network usage. The processor 1110 of the endpoint1100 may predict application usage based on other application usagepatterns for the endpoint. The processor 1110 of the endpoint 1100 mayprovide information about anticipated volume of network traffic based onpast patterns of executing that routine, for example, as stored in thepattern data 1133.

In response to receipt of such indications, the processor 1510 of thefirewall 1500 may be caused to derive one or more network configurationchanges to be made, for example, to maximize QoS of the network based onthe overall anticipated network usage. For example, the firewall 1500may direct WAPs to change frequency or speed settings. The firewall 1500may direct endpoints 1100 to connect to other WAPs 1300 to distributenetwork traffic more effectively.

In some implementations, the processor 1510 of the firewall 1500 mayrelay indications of expected network usage and/or the operation,commencement of execution and/or expected cessation of execution ofroutines on the endpoint 1100 to the WAP 1300. In response to receipt ofsuch indications, the processor 1310 of the WAP 1300 may be caused bythe wireless routine 1329 to derive one or more setting changes to bemade to adjust the bandwidth available through the wireless link 1290 toaccommodate the volume of network traffic that is indicated as expected.Again, such a derived setting change may be of a type that is able to beeffected entirely at the WAP 1300, or may be of a type that must beeffected at least at the endpoint 1100 such that the secure channels1492 and 1292 must be used to convey a command to the security routine1120 to do so.

In some implementations, observations of patterns of network usage maybe detected and indications thereof directly stored by the endpoint1100, the WAP 1300 and/or the firewall 1500. By way of example, theprocessor 1310 of the WAP 1300 may be caused to monitor and storeindications of amounts of network use by multiple endpoints 1100 atvarious times of day and/or days of a week. Thus, if the depictedendpoint 1100 is observed to have a pattern of exchanging a particularlyhigh volume of network traffic through the depicted wireless link 1290starting at a similar time each weekday and/or ending at another similartime each weekday, then indications of that pattern may be stored in thepattern data 1333. The processor 1310 may then be caused by the wirelessroutine 1329 to recurringly refer to those indications of that pattern,and in response to the approach of a time at which that particularlyhigh volume of exchange of network traffic is expected to commence, theprocessor 1310 may be caused to access the wireless interface 1309 w topreemptively effect a setting change. In some implementations, theprocessor 1310 of the WAP 1300 may be caused to transmit a request tothe firewall 1500 via the secure channel 1492 for a command to betransmitted via the secure channel 1292 to the security routine 1120 topreemptively effect a setting change. The setting change may have beenderived, for example, by the processor 1310 under the control of thewireless routine 1329 to increase the available bandwidth (andtherefore, the QOS) of the wireless link 1290 in anticipation of theparticularly high volume of network traffic to be exchanged. Then, afterthe particularly high volume of exchanged network traffic ceases and/orupon arrival of the time at which the particularly high volume ofexchange network traffic has usually ceased, the processor 1310 mayaccess the wireless interface 1309 w to undo the earlier setting change,and/or may transmit a request via the secure channel 1492 to transmit acommand to the security routine 1120 via the secure channel 1292 to undothe earlier setting change.

FIG. 8A illustrates, by example, use of one or more secure channels inan example networking system 1000 to exchange communications associatedwith network performance for more than one endpoint 1100 a, 1100 b.Again, the depicted network elements are intended as a simple example,and there may be any number of endpoints 1100, WAPs 1300, and firewalls1500. There may be one or more than one internal network 1490. There maybe one or more than one wireless link 1290. The two endpoints 1100 a,1100 b are depicted as communicating over the same wireless link 1290,which may be an 802.11 wireless network (e.g., one or more of the802.11g, 802.11n, 802.11ac standards promulgated by IEEE).

In this example, a setting change is prompted by an anticipated or adetected network performance issue, for example, based on actual usageor based on stored indications of a recurring pattern. In suchsituations, coordination among at least the two endpoints 1100 a, 1100 band the WAP 1300 and/or the firewall 1500 may be desired. This may bedue to the at least two endpoints 1100 a, 1100 b sharing the samewireless network, and so setting changes that affect the wireless link1290 affect both endpoints 1100 a, 1100 b.

In this example, a setting change that affects the wireless link 1290 bywhich the endpoints 1100 a, 1100 b are coupled to the WAP 1300 may needto be coordinated between the endpoints 1100 a, 1100 b. Where bothsetting changes are able to be effected entirely at the WAP 1300, thenthe processor 1310 may be caused by the wireless routine 1329 to accessthe wireless interface 1309 w to so effect both setting changes.However, where a setting change cannot be made entirely at the WAP 1300,or where the setting change may affect the user(s) of one or both of theendpoints 1100 a, 1100 b, and coordination would minimize or make theimpact on the user(s) negligible, then the processor 1310 may be causedby the wireless routine 1329 to transmit a request to the firewall 1500through the secure channel 1492 to transmit commands to both of thesecurity routines 1120 a and 1120 b within the endpoints 1100 a and 1100b, respectively, via corresponding ones of the secure channels 1292 aand 1292 b to effect setting change(s) that affect the wireless link1290. In response, whichever one(s) of the security routines 1120 a and1120 b receive such a command may cause their respective processor 1110to access their respective wireless interface 1109 w withincorresponding ones of the endpoints 1100 a and 1100 b to affect thespecified setting change.

In some implementations, it may be the processor 1310 of the WAP 1300that derives the setting changes to be made that are associated with thewireless link 1290. However, in other implementations, it may be thatthe processor 1510 of the firewall 1500 to which the WAP 1300 is coupledvia an intermediate network 1490, or it may be the processor 1710 of thesupervisor 1700 (referring additionally to FIG. 5B) that derives thesetting changes. It may be deemed desirable for either processor 1510 ofthe firewall 1500 or the processor 1710 of the supervisor 1700 to derivesuch setting changes in implementations of the networking system 1000 inwhich commands to effect coordinated setting changes may need to betransmitted to instances of the security routine 1120 present withinmultiple endpoints 1100 that are coupled to different WAPs 1300 and/orto different firewalls 1500.

FIG. 8B depicts such an exchange of communications associated with twodifferent wireless networks 1290 a and 1290 b that are each establishedwith a different WAP 1300 a and 1300 b, respectively. Each of theendpoints 1100 a and 1100 b are coupled by corresponding ones of thewireless links 1290 a and 1290 b to corresponding ones of the WAPs 1300a and 1300 b. In this example, the proximity of the endpoints 1100 a and1100 b, and/or of the WAPs 1300 a and 1300 b may be close enough that achange that affects the wireless link 1290 a may affect the performanceof the wireless link 1290 b. In response to both of the WAPs 1300 a and1300 b being coupled to the same firewall 1500, it may be the processor1510 that is caused by the firewall routine 1520 to derive correspondingsetting changes to be effected by corresponding ones of the securityroutines 1120 a and 1120 b. The processor 1510 may then be caused totransmit separate commands to each of the security routines 1120 a and1120 b via corresponding ones of the secure channels 1292 a and 1292 bto each effect one of the corresponding setting changes to each change acharacteristic of a corresponding one of the wireless links 1290 a and1290 b.

For example, where the WAP 1300 a and the WAP 1300 b are both operatingon the same frequency, both the endpoints 1100 a, 1100 b may both reporta characteristic such as a number of dropped packets that meets athreshold, which indicates poor performance. In this example, bothendpoints 1100 a, 1100 b may report that both WAPs 1300 a, 1300 b arevisible with a signal strength that indicates that the WAPs 1300 a, 1300b, or the endpoints 1100 a, 1100 b that are connected to them may beinterfering with each other. As a result, the firewall 1500 may directthe endpoint 1100 a and the WAP 1300 a to change frequency, and/ordirect the endpoint 1100 b and the WAP 1300 b to change frequency. Thefirewall 1500 may direct the endpoints 1100 a, 1100 b and the WAPs 1300a, 1300 b to reduce their broadcast power. The firewall may direct oneof the endpoints 1100 a, 1100 b, to connect to the other WAP. Thefirewall 1500 may direct one of the endpoints 1100 a, 1100 b and/or theWAPs 1300 a, 1300 b to change other operating parameters, such astransmission speed. Following these commands, the firewall may observethe network performance to determine whether any further changes areneeded.

FIG. 9A illustrates an example implementation of a network system 1000at a site in which there are three WAPs 1300 (designated with thereference numbers 1300 a, 1300 b and 1300 c), and a number of endpoints1100 (designated with the reference numbers 1100 a through 1100 u). Thedepicted quantities of endpoints 1100 and WAPs 1300 are illustrative,and it should be understood that the quantity, type, and configurationof the endpoints 1100 and WAPs 1300 may vary by implementation. Asdepicted, the WAPs 1300 a-c may be connected through an intermediatenetwork 1490 to a firewall 1500. The depicted intermediate network 1490may provide each of the WAPs 1300 a-c with a direct or indirectconnection (depicted with solid lines) via wired connections that mayeach include one or more intermediate devices to the firewall 1500. Thefirewall 1500 may have, or may directly store and/or may otherwise haveaccess to, a database of information describing various capabilities ofone or more of the WAPs 1300 a-c, and/or of one or more of the endpoints1100 a-u, including and not limited to, the wireless networkingcapabilities as determined by installed hardware and software.

The firewall 1500 may directly store and/or may otherwise have access toa database of information describing the physical locations of one ormore of the WAPs 1300 a-c, and/or of one or more of the endpoints 1100a-u. For example, locations of one or more of the endpoints 1100 a-uthat have fixed locations (e.g., desktop computers, kiosk stations,etc.) may be included in such a database. Alternatively or additionally,locations of one or more of the endpoints 1100 a-u (whether fixed, ornot) may be determined by triangulation based on signal strengthsdetected by two or more of the WAPs 1300 a-c, through the use of nearfield communications, other location information, or some combinationthereof.

Each of the WAPs 1300 a-c may establish a respective securecommunication channel (e.g., a separate instance of the secure channel1492), with the firewall 1500. With such secure communication channelsestablished, the WAPs 1300 a-c may each communicate security-relatedinformation over a corresponding one of those secure channels to thefirewall 1500. The communication of security-related information maytake place, for example, on a schedule, from time-to-time, or uponrequest. For example, the security-related information may include asecurity health status report of one or more of the WAPs 1300 a-c, andmay include alerts related to actual or suspected attacks, andsuspicious behavior of one or more of the endpoints 1100 a-u, users,processes, and applications.

The dotted lines each represent a wireless link 1290 established betweenone of the endpoints 1100 a-u and one of the WAPs 1300 a-c. For example,in a conventional environment, one of the endpoints 1100 a-u may use alist of network names (e.g., SSID) or manual configuration to identifyone of the WAPs 1300 a-c to connect to, and connect to the one of theWAPs 1300 a-c that is able provide, for example, the greatest signalstrength or channel bandwidth.

As a demonstrative example, one of the endpoints 1100 a, may establish aconnection to one of the WAPs 1300 a by joining a wireless networkprovided by the WAP 1300 a. This may include associating the endpoint1100 a with the WAP 1300 a, an exchange of authentication credentials(e.g., WEP, WPA, or WPA2 password), and assignment of a logical port(e.g., association ID) along with communication of supported data ratesto the 1100 a in accordance with a protocol (e.g., one of the 802.11series protocols promulgated by IEEE). As a result, a wireless link 1290may be formed between the WAP 1300 a and the endpoint 1100 a by whichdata may be exchanged therebetween and/or through which the endpoint1100 a may be able to communicate with the firewall 1500.

By way of example, once a wireless link 1290 is established between theendpoint 1100 a and the WAP 1300 a, the endpoint 1100 a and the firewall1500 may cooperate to establish a secure channel (e.g., an instance ofthe secure channel 1292) therebetween through the wireless link 1290,the WAP 1300 a and the intermediate network 1490. With the securechannel established, the endpoint 1100 a may communicatesecurity-related information over the secure channel to the firewall1500. The communication of security-related information may take place,for example, on a schedule, from time-to-time, or upon request. Forexample, the security-related information may include a security healthstatus report of the endpoint, and may include alerts related to actualor suspected attacks, and suspicious behavior of users, processes, andapplications.

In some implementations, on a schedule, from-time-to-time, or uponrequest, the endpoint 1100 a may report network performance status overthe secure channel. Network communication status may be reported asalongside the security-related information such that both the wirelesscommunication status and security-related information share the securechannel. For example, a single combined report may include securityhealth status and network performance status. Alternatively oradditionally, network performance status may be reported separately fromthe security-related information. For example, a report may include onlyone or other of the security health status and network communicationstatus. In some implementations, a network device (e.g., a WAP 1300, afirewall 1500, a supervisor 1700, etc.) may query the endpoint 1100 ausing the secure channel for information about its network performancestatus.

The network communication status may include information about wired orwireless networks (e.g., Wi-Fi networks based on one or more of the IEEE802.11 series of standards, Bluetooth networks based on the Bluetoothspecification promulgated by the Bluetooth Special Interest Group ofKirkland, Wash., USA). Network communication status may include currentnetwork usage and performance and anticipated network usage andperformance.

With respect to wireless networks, the network performance status mayinclude any suitable information about one or characteristics of thewireless link established between the endpoint 1100 a and the WAP 1300a. For example, the endpoint 1100 a may report one or more of signalstrength, channel, transmission rates, interface statistics, errorcounters, device settings and configuration parameters, wireless devicesor WAPs 1300 a-c that are visible or available and information aboutthem (e.g., signal strength, channel). The endpoint 1100 a may reportits own network usage, which may include detail of network usage byapplications or processes executed within the endpoint 1100 a. In someimplementations, a report of wireless communication status may be madein response to a query over the secure channel. For example, a networkdevice such as the firewall 1500 may request a report, periodic reports,or specific information.

In some implementations, the WAP 1300 a may periodically, from time totime, or upon request, report wireless communication status over asecure channel established between the WAP 1300 a and the firewall 1500.The wireless communication status may be communicated as part of orseparately from a security health status report.

For example, the WAP 1300 a may report on which of the endpoints 1100a-u are in communication with the WAP 1300 a through a wireless link1290 with the WAP 1300 a, as well as information about characteristicsof one or more of those wireless links 1290. Examples of informationabout the wireless links 1290 may include any or all of signal strength,transmission rate, interface statistics, error counters, device settingsand configuration parameters, wireless devices or WAPs 1300 a-c that arevisible or available bandwidth usage, QoS requirements,channel/bandwidth capability, channel(s) in use, transmission rate, orany other suitable information about the WAP 1300 a or the ones of theendpoints 1100 a-u that may be in communication with the WAP 1300 a viaone of the wireless links 1290. For example, the WAP 1300 a may reportinformation about one or both of the other WAPs 1300 b-c that it mayreceive in beacon frames transmitted by one or both of the WAPs 1300b-c, including evaluations of the signal strength of the beacon framesreceived from one or both of the WAPs 1300 b-c.

From information received over secure channels from one or more of theendpoints 1100 a-u and one or more of the WAPs 1300 a-c, a model of thecurrent configuration of wireless networks at the site (e.g., of thenetworking system 1000) may be developed. From the model, potential oractual QOS issues may be identified. Such QOS issues may include, forexample, congestion, a quantity of endpoints 1100 participating inwireless networking provided by each of the WAPs 1300 a-c, a quantity ofendpoints 1100 with a high degree of network utilization, etc. In someimplementations, a model may include times of day and anticipated usagebased on historical information. In some implementations, a model mayinclude usage models associated with specific endpoints 1100 a-u, users,or applications/processes running on the endpoints 1100 a-u. Portions ofthe model may be determined on the endpoint 1100 a-u and communicated tothe firewall 1500. For example, anticipated network usage based on theapplications may be determined on each endpoint 1100 a-u.

Using the model, changes to the configuration of one or more of thewireless links 1290 and the endpoints 1100 a-u of the networking system1000 may be derived. For example, proposed network configurations of oneor more of the endpoints 1100 a-u and/or one or more of the WAPs 1300a-c, associated channels for such communication, wireless linkparameters, etc. may be derived that may maximize the overall perceivedor actual performance of the wireless links 1290 within the networkingsystem 1000. For example, the firewall 1500 may send an instruction oversecure channels to one or more of the WAPs 1300 a-c and/or one or moreof the endpoints 1100 a-u to coordinate network configuration changes,including more specifically, in this example, changes to one or morecharacteristics of one or more of the wireless links 1290.

As depicted in FIG. 9A, endpoints 1100 a-f are coupled by wireless links1290 to the WAP 1300 a; endpoints 1100 g-q are coupled by wireless links1290 to the WAP 1300 b; and endpoints 1100 r-u are coupled by wirelesslinks 1290 to WAP 1300 c. In this example, WAP 1300 b, and/or one ormore of the endpoints 1100 g-q that are coupled to the WAP 1300 b mayreport information to the firewall 1500 that may be indicative ofcongestion. It may be that many of endpoints 1100 g-q that are coupledto the WAP 1300 b also report that they are able to connect with one orthe other of the WAPs 1300 a and 1300 c with sufficient (or in somecases, better) signal strength. It may also be that the firewall 1500has previously received indications that at least some of the endpoints1100 g-q that are coupled to the WAP 1300 b are capable of connecting toone or the other of the WAPs 1300 a and 1300 c based on their wirelessnetworking hardware and software. Such information may be stored in adatabase of information associated with each of the endpoints 1100 a-uand/or may be retrieved by the firewall 1500 from each of the endpoints1100 a-u. It may be that the firewall 1500 has received indications ofcurrent and/or anticipated network usage of the endpoints 1100 a-u.Based on such information, the firewall 1500, the supervisor 1700, oranother device (not depicted), may derive one or more changes to be madeto the network configuration of the networking system 1000 (e.g.,changes to one or more of the wireless links 1290) to improve overallperformance.

Such proposed changes may include switching one or more of the endpoints1100 g-q from being coupled to the WAP 1300 b to being coupled to one orthe other of the WAPs 1300 a and 1300 b. More specifically, as depictedin FIG. 9B, the endpoints 1100 i-j may be directed to end theirrespective wireless links 1290 with the WAP 1300 b, and to establish newwireless links 1290 with the WAP 1300 a. Also, the endpoints 1100 m-pmay be directed to end their respective wireless links 1290 with the WAP1300 b, and to establish new wireless links 1290 with the WAP 1300 c. Asa result, and as depicted in FIG. 9B, the quantity of endpoints coupledby wireless links 1290 to the WAP 1300 b is reduced, thereby alleviatingthe congestion.

The firewall 1500 may transmit such commands to each of the endpoints1100 i-j and 1100 m-p through secure connections established between thefirewall 1500 and each of these endpoints 1100 i-j and 1100 m-p throughintermediate network 1490, the WAP 1300 b and corresponding ones of thewireless links 1290 that were already established with the WAP 1300 b.Each of such commands may include connection information for use inestablishing the new wireless links 1290 with a corresponding one of theWAPs 1300 a and 1300 c. Each of such commands may specify a time toswitch to being coupled to a corresponding one of the WAPs 1300 a and1300 c, where the each such specified time may be selected to minimizedisruption to a user of one or more of the endpoints 1100 i-j and/or1100 m-p. Alternatively or additionally, the firewall 1500 may transmitcommands to one or more of the WAPs 1300 a-c to effect such changes inthe wireless links associated with the endpoints 1100 i-j and 1100 m-p.

In some implementations, changes to the network configuration of thenetworking system 1000 may be determined based on one or more of WAPcapacity, endpoint network usage, relative signal strength, balancingcapacity, which of WAPs 1300 a-c are wirelessly accessible to each ofthe endpoints 1100 a-u, networking protocol/channel compatibility, andother information. In some implementations, changes to the networkconfiguration may be determined based on historical network usage at thesite. In some implementations, changes to the network configuration maybe determined based on historical network usage of one or more of theendpoints 1100 a-u. In some implementations, changes to the networkconfiguration may be determined based on historical network usage of oneor more of the users of one or more of the endpoints 1100 a-u.

In some implementations, couplings by individual wireless links 1290 ofeach of the endpoints 1100 a-u may be distributed among the WAPs 1300a-c based on historical, current and/or anticipated network capacityusage. For example, users, endpoints, or processes that regularly have alarge number of video conferences may require greater network capacitythan other users. For example, users that often download large files mayuse more network capacity.

In some implementations, the firewall 1500 may direct one or more of theendpoints 1100 a-u and/or one or more of the WAPs 1300 a-c to use aparticular channel or communication rate. For example, the firewall 1500may determine that certain ones of the endpoints 1100 a-u and at leastone of the WAPs 1300 a-c are capable of using a higher communicationrate, a channel with a higher frequency carrier signal that enables ahigher communication rate (e.g., a 5 GHz channel), and/or a combinationof channels that enables a higher communication rate. The ones of theendpoints 1100 a-u that are so capable may be directed to establishtheir wireless links 1290 with at least one of the WAPs 1300 that isalso so capable, while others of the endpoints 1100 a-u that are not socapable may be directed to establish their wireless links 1290 withanother of the WAPs 1300 a-c.

In some implementations, the firewall 1500 and/or the supervisor 1700may direct one or more of the endpoints 1100 a-u to establish theirwireless links 1290 with a particular one of the WAPs 1300 a-c or tochange which one of the WAPs 1300 a-c to which each is coupled via awireless link 1290 in response to receiving an indication of a securityevent. For example, if one of the WAPs 1300 a-c is suspected of havingbeen compromised or is determined to have been compromised, then one ormore of the endpoints 1100 a-c may be directed to use another of theWAPs 1300 a-c. For example, if one of the WAPs 1300 a-c indicates in asecurity report transmitted to the firewall 1500 and/or the supervisor1700 that its security health may be compromised, the firewall 1500and/or the supervisor 1700 may direct one or more of the endpoints 1100a-u to switch to another of the WAPs 1300 a-c. For example, if one ofthe endpoints 1100 a-u coupled to one of the WAPs 1300 a-c indicates ina security report transmitted to the firewall 1500 and/or the supervisor1700 that its security health may be compromised, the firewall 1500and/or the supervisor 1700 may direct one or more of the other endpoints1100 a-u that are also coupled to the same one of the WAPs 1300 a-c toswitch to another of the WAPs 1300 a-c. Moving those other ones of theendpoints 1100 a-u to other(s) of the WAPs 1300 a-c may assist incontaining a security risk that may be posed by that one of theendpoints 1100 a-u having been compromised by isolating that one of theendpoints 1100 a-u to that one of the WAPs 1300 a-c. Moving the thoseother ones of the endpoints 1100 a-u to other(s) of the WAPs 1300 a-cmay also enable an administrator of the networking system 1000 to moreeasily limit network traffic to and from that one of the endpoints 1100a-u.

Referring back to FIGS. 5A-C, 6A-C, 7 and 8A-B, each of the processors1110, 1310, 1510 and 1710 may include any of a wide variety ofcommercially available processors. Further, one or more of theseprocessors may include multiple processors, a multi-threaded processor,a multi-core processor (whether the multiple cores coexist on the sameor separate dies), and/or a multi-processor architecture of some othervariety by which multiple physically separate processors are linked.

Each of the storages 1111, 1311, 1511 and 1711 may be based on any of awide variety of information storage technologies, including volatiletechnologies requiring the uninterrupted provision of electric power,and/or including technologies entailing the use of machine-readablestorage media that may or may not be removable. Thus, each of thesestorages may include any of a wide variety of types (or combination oftypes) of storage device, including without limitation, read-only memory(ROM), random-access memory (RAM), dynamic RAM (DRAM), Double-Data-RateDRAM (DDR-DRAM), synchronous DRAM (SDRAM), static RAM (SRAM),programmable ROM (PROM), erasable programmable ROM (EPROM), electricallyerasable programmable ROM (EEPROM), flash memory, polymer memory (e.g.,ferroelectric polymer memory), ovonic memory, phase change orferroelectric memory, silicon-oxide-nitride-oxide-silicon (SONOS)memory, magnetic or optical cards, one or more individual ferromagneticdisk drives, or a plurality of storage devices organized into one ormore arrays (e.g., multiple ferromagnetic disk drives organized into aRedundant Array of Independent Disks array, or RAID array). It should benoted that although each of these storages is depicted as a singleblock, one or more of these may include multiple storage devices thatmay be based on differing storage technologies. Thus, for example, oneor more of each of these depicted storages may represent a combinationof an optical drive or flash memory card reader by which programs and/ordata may be stored and conveyed on some form of machine-readable storagemedia, a ferromagnetic disk drive to store programs and/or data locallyfor a relatively extended period, and one or more volatile solid statememory devices enabling relatively quick access to programs and/or data(e.g., SRAM or DRAM). It should also be noted that each of thesestorages may be made up of multiple storage components based onidentical storage technology, but which may be maintained separately asa result of specialization in use (e.g., some DRAM devices employed as amain storage while other DRAM devices employed as a distinct framebuffer of a graphics controller).

Each of the interfaces 1109 w, 1309 w, 1309 n, 1509 n and 1709 n mayemploy any of a wide variety of communications technologies enablingthese devices to be coupled to other devices as has been described. Eachof these interfaces includes circuitry providing at least some of therequisite functionality to enable such coupling. However, each of theseinterfaces may also be at least partially implemented with sequences ofinstructions executed by corresponding ones of the processors (e.g., toimplement a protocol stack or other features). Where electrically and/oroptically conductive cabling is employed, these interfaces may employtimings and/or protocols conforming to any of a variety of industrystandards, including without limitation, RS-232C, RS-422, USB, Ethernet(IEEE-802.3) or IEEE-1394. Where the use of wireless transmissions isentailed, these interfaces may employ timings and/or protocolsconforming to any of a variety of industry standards, including withoutlimitation, IEEE 802.11a, 802.11ac, 802.11b, 802.11g, 802.11n, 802.16,802.20 (commonly referred to as “Mobile Broadband Wireless Access”);Bluetooth; ZigBee; or a cellular radiotelephone service such as GSM withGeneral Packet Radio Service (GSM/GPRS), CDMA/1×RTT, Enhanced Data Ratesfor Global Evolution (EDGE), Evolution Data Only/Optimized (EV-DO),Evolution For Data and Voice (EV-DV), High Speed Downlink Packet Access(HSDPA), High Speed Uplink Packet Access (HSUPA), 4G LTE, etc.

FIG. 10 illustrates a flow diagram of an example implementation ofpreparations for communications through a networking system. The logicflow 2100 may be representative of some or all of the operationsexecuted by implementations of one or more devices described herein.More specifically, the logic flow 2100 may illustrate operationsperformed by the processor 1110 in executing at least the securityroutine 1120, and/or performed by other components of an implementationof one of the endpoints 1100.

At 2110, a processor of an endpoint in a networking system (e.g., theprocessor 1110 of one of the endpoints 1100 in the networking system1000) may exchange a first level of security credentials with a WAP(e.g., one of the WAPs 1300). At 2120, the processor cooperates with theWAP to establish a wireless link therewith (e.g., one of the wirelesslinks 1290) in response to a successful first level of authentication ofthe WAP. As previously discussed, the formation of one of the wirelesslinks 1290 with one of the WAPs 1300 may be conditioned on a successfulauthentication of that WAP 1300.

At 2130, the processor may be caused by its execution of a securityroutine within the endpoint (e.g., an instance of the security routine1120 within one of the endpoints 1100) to exchange a second level ofsecurity credentials with either a firewall or a supervisor (e.g., oneof the firewalls 1500 or a server that serves as the supervisor 1700).As previously discussed, in implementations of the networking system1000 in which neither one of the firewalls 1500 nor the supervisor 1700is integrated with a WAP 1300, then the security routine 1120 executedwithin an endpoint coupled to that WAP 1300 via a wireless link 1290 mayexchange security credentials with one of the firewalls 1500 or thesupervisor 1700 through that WAP 1300.

At 2140, the processor cooperates with the firewall or supervisor withwhich it exchanged the second level security credentials to establish asecure channel therewith (e.g., one of the secure channels 1292) throughat least the wireless link in response to a successful second level ofauthentication of that firewall or supervisor. As previously discussed,where security credentials are exchanged through one of the WAPs 1300with either one of the firewalls 1500 or the supervisor 1700, and thereis successful authentication, then the resulting secure channel 1292formed therewith may extend through that WAP 1300.

FIG. 11 illustrates a flow diagram of an example implementation ofpreparations for communications through a networking system. The logicflow 2200 may be representative of some or all of the operationsexecuted by implementations of one or more devices described herein.More specifically, the logic flow 2200 may illustrate operationsperformed by the processor 1310 in executing at least the wirelessroutine 1329, and/or performed by other components of an implementationof one of the WAPs 1300.

At 2210, a processor of a WAP in a networking system (e.g., theprocessor 1310 of one of the WAPs 1300 in the networking system 1000)may exchange a first level of security credentials with an endpoint(e.g., one of the endpoints 1100). At 2220, the processor cooperateswith the endpoint to establish a wireless link therewith (e.g., one ofthe wireless links 1290) in response to a successful first level ofauthentication of the endpoint. As previously discussed, the formationof one of the wireless links 1290 with one of the endpoints 1100 may beconditioned on a successful authentication of that endpoint 1100.

At 2230, the processor may route, through the WAP, an exchange of asecond level of security credentials with a security routine executedwithin the endpoint (e.g., an instance of the security routine 1120).Again, in implementations of the networking system 1000 in which neitherone of the firewalls 1500 nor the supervisor 1700 is integrated with aWAP 1300, then the security routine 1120 executed within an endpointcoupled to that WAP 1300 via a wireless link 1290 may exchange securitycredentials with one of the firewalls 1500 or the supervisor 1700through that WAP 1300.

At 2140, the processor may route, through the WAP, a secure channelestablished with the security routine (e.g., one of the secure channels1292) in response to a successful second level of authentication of thatsecurity routine. As previously discussed, where security credentialsare exchanged through one of the WAPs 1300 between an instance of thesecurity routine 1120 and either one of the firewalls 1500 or thesupervisor 1700, and there is successful authentication, then theresulting secure channel 1292 formed therebetween may extend throughthat WAP 1300.

FIG. 12 illustrates a flow diagram of an example implementation ofpreparations for communications through a networking system. The logicflow 2300 may be representative of some or all of the operationsexecuted by implementations of one or more devices described herein.More specifically, the logic flow 2300 may illustrate operationsperformed by either the processor 1510 or 1710 in executing at least thefirewall routine 1520 or at least the supervisory routine 1720, and/orperformed by other components of an implementation of one of thefirewalls 1500 or of the supervisor 1700, respectively.

At 2310, a processor of a firewall or of a server that serves as asupervisor in a networking system (e.g., the processor 1510 of one ofthe firewalls 1500 or the processor 1710 of the supervisor 1700 in thenetworking system 1000) may receive an indication from a WAP in thenetworking system (e.g., one of the WAPs 1300) of a successful firstlevel of authentication of an endpoint (e.g., one of the endpoints1100). At 2320, the processor may then receive, from that WAP, anindication of the successful establishment of a wireless link betweenthat WAP and that endpoint (e.g., one of the wireless links 1290). Aspreviously discussed, the formation of one of the wireless links 1290between one of the endpoints 1100 and one of the WAPs 1300 may beconditioned on a successful authentication of at least one of those twodevices by the other.

At 2330, in response to the successful first level authentication andestablishment of the wireless link, the processor may exchange, throughthe WAP, a second level of security credentials with a security routineexecuted within the endpoint (e.g., an instance of the security routine1120). Again, in implementations of the networking system 1000 in whichneither one of the firewalls 1500 nor the supervisor 1700 is integratedwith a WAP 1300, then the security routine 1120 executed within anendpoint coupled to that WAP 1300 via a wireless link 1290 may exchangesecurity credentials with one of the firewalls 1500 or the supervisor1700 through that WAP 1300.

At 2340, in response to a successful second level authentication of thesecurity routine executed within the endpoint, the processor mayestablish a secure channel with that security routine through the WAP(e.g., one of the secure channels 1292). As previously discussed, wheresecurity credentials are exchanged through one of the WAPs 1300 betweenan instance of the security routine 1120 and either one of the firewalls1500 or the supervisor 1700, and there is successful authentication,then the resulting secure channel 1292 formed therebetween may extendthrough that WAP 1300.

FIG. 13 illustrates a flow diagram of an example implementation ofperformance of communications through a networking system. The logicflow 2400 may be representative of some or all of the operationsexecuted by implementations of one or more devices described herein.More specifically, the logic flow 2400 may illustrate operationsperformed by the processor 1110 in executing at least the securityroutine 1120, and/or performed by other components of an implementationof one of the endpoints 1100.

At 2410, a processor of an endpoint in a networking system (e.g., theprocessor 1110 of one of the endpoints 1100 in the networking system1000) may monitor the security status of the endpoint. As previouslydiscussed, the monitoring of the security status of one of the endpoints1100 may entail analyzing routines stored and/or executed within thatendpoint for signatures and/or patterns of behavior associated with apiece of malware. As also previously discussed, such analysis ofexecutable routines is just one of many techniques that may be appliedto the monitoring of the security status of a device, as will befamiliar to those skilled in the art.

At 2420, the processor may check whether it is time to transmit anindication of the security status of the endpoint. As previouslydiscussed, the processor 1110 of one of the endpoints 1100 may be causedby an instance of the security routine 1120 to recurringly transmitindications of the security status of that endpoint 1100 to one of thefirewalls 1500 on a recurring basis that may be based on a recurringinterval of time. As a result, such recurring transmissions may serve asa form of security “heartbeat” transmission. If, at 2420, it is time totransmit an indication of the security status, then the processor may doso at 2422.

At 2430, the processor may check whether it is time to transmit anindication of the network performance status of the endpoint. Aspreviously discussed, the processor 1110 of one of the endpoints 1100may be caused by an instance of the security routine 1120 to recurringlytransmit indications of the network performance status of that endpoint1100 to one of the firewalls 1500 on a recurring basis that may be basedon a recurring interval of time. As a result, such recurringtransmissions may serve as a form of network performance “heartbeat”transmission. If, at 2430, it is time to transmit an indication of thenetwork performance status, then the processor may do so at 2432.

At 2440, the processor may check whether a command to affect a settingchange associated with network performance has been received via asecure channel established through that wireless link. As previouslydiscussed, a command to affect a setting change of a characteristic ofone of the wireless links 1290 may be transmitted to the instance of thesecurity routine 1120 executed within the endpoint 1100 coupled to oneend of that wireless link at the request of the WAP coupled to the otherend of that wireless link for any of a variety of reasons. Such reasonsmay include a detected reduction in QOS of the wireless link, or makinga preemptive change to the QOS of the wireless link in anticipation ofupcoming network traffic therethrough. The command may include anychanges necessary to improve wired or wireless network performance. Thenetwork performance may be the communication network between theendpoint and a WAP (e.g., Wi-Fi network) or may be another communicationnetwork (e.g., Bluetooth, near field communication), or may be a wirednetwork.

If, at 2440, such a command has been received, then at 2442, theprocessor may access the appropriate communications interface of theendpoint to affect the setting change associated with networkperformance that is specified in the command. As previously discussed,an instance of the security routine 1120 executed within one of theendpoints 1100 may so access the wireless interface 1109 w thereof toaffect such a commanded setting change in a manner that bypasses one ormore other routines that would normally access the wireless interface1109 w, such as the network driver 1129.

FIG. 14 illustrates a flow diagram of an example implementation ofperformance of communications through a networking system. The logicflow 2500 may be representative of some or all of the operationsexecuted by implementations of one or more devices described herein.More specifically, the logic flow 2500 may illustrate operationsperformed by the processor 1310 in executing at least the wirelessroutine 1329, and/or performed by other components of an implementationof one of the WAPs 1300.

At 2510, a processor of a WAP in a networking system (e.g., theprocessor 1310 of one of the WAPs 1300 in the networking system 1000)may monitor the QOS of a wireless link established between the WAP andan endpoint (e.g., one of the wireless links 1290 established with oneof the endpoints 1100). Other information may be monitored as well,including without limitation the WAP itself, the endpoints connected tothe WAP, other WAPs and devices connected to other WAPs, and WAPs andendpoints connected to other firewalls.

At 2520, the processor may check whether the overall network performanceis within predetermined thresholds. More precisely, and as previouslydiscussed, there may be minimum and/or maximum values for variouscharacteristics of one of the wireless links 1290 that are defined byvarious network performance thresholds. As long as the characteristicsof the overall network and/or each network, wireless link 1290, WAP,endpoints, etc. do not violate any of such minimum or maximum values,then the network performance may be deemed to be acceptable. Otherwise,if one of the characteristics violates one or more of the correspondingminimum and/or maximum values, then one or more aspects of the networkmay be deemed to have fallen outside one or more of the thresholds.

If, at 2520, the network performance is within the predeterminedthresholds, then the processor may return to monitoring the networkperformance. However, if one or more aspects of the network performance(e.g., performance at one or more wireless links) has fallen outside athreshold at 2520, then the processor may derive a setting changeaffecting the network so as to bring the network performance (e.g.,performance at one or more wireless links) back within the predeterminedthresholds.

At 2530, the processor may check whether effecting the derived settingchange requires setting changes at multiple endpoints. If so, then at2532, the processor may transmit requests to a firewall device or aserver that serves as a supervisor of the networking system (e.g., oneof the firewall devices 1500 or the supervisor 1700) for that firewallor supervisor to transmit commands to the security routines of thosemultiple endpoints to effect setting changes that affect the wirelesslinks by which each is coupled to a WAP of the networking system.Likewise, if other devices are involved in the changes, e.g., WAPs,routers, gateways, firewalls, etc., they will be directed to make thechanges.

However, if effecting the derived setting change does not requiresetting changes at multiple endpoints at 2530, then the processor maycheck at 2540 whether the derived setting change requires a settingchange at the single endpoint associated with the change. If so, then at2542, the processor may transmit a request to the firewall device or thesupervisor for that firewall or supervisor to transmit a command to thesecurity routine of the single endpoint to affect the setting change.

Regardless of whether effecting the derived setting change requiredsetting changes at multiple endpoints, at the single endpoint, or not atany endpoint, at 2550, the processor may check whether effecting thederived setting change requires coordinated setting changes at multipleWAPs. If not, then the processor may affect the derived setting changeat the WAP at 2554, before returning to monitoring the networkperformance.

However, if coordinated setting changes are required at multiple WAPs,then at 2552, the processor may coordinate its effecting of the derivedsetting change with the effecting of corresponding setting change(s) atthe other WAP(s). As previously discussed, such coordination with one ormore other WAPs may require communication through at least one firewalldevice and/or through the supervisor, depending on the relativelocations of the WAPs to be coordinated within the topology of thenetworking system.

FIG. 15 illustrates a flow diagram of an example implementation ofpreparations for communications through a networking system. The logicflow 2600 may be representative of some or all of the operationsexecuted by implementations of one or more devices described herein.More specifically, the logic flow 2600 may illustrate operationsperformed by either the processor 1510 or 1710 in executing at least thefirewall routine 1520 or at least the supervisory routine 1720, and/orperformed by other components of an implementation of one of thefirewalls 1500 or of the supervisor 1700, respectively.

At 2610, a processor of a firewall or of a server that serves as asupervisor in a networking system (e.g., the processor 1510 of one ofthe firewalls 1500 or the processor 1710 of the supervisor 1700 in thenetworking system 1000) may receive an indication in the networkingsystem (e.g., one of the WAPs 1300) of a need to coordinate settingchanges affecting multiple network elements (e.g., multiple ones of thewireless links 1290, endpoints 1100, WAPs 1300, etc.). As previouslydiscussed, the received indication may specify the setting changeneeding to be made for particular wireless link that may be reason whycoordinated setting changes are required that involve one or more otherWAPs.

At 2620, the processor may then identify the one or more other deviceswith which setting changes are to be coordinated. At 2630, the processormay derive the setting change(s) for the one or more other devices. Aspreviously discussed, one or more of the firewalls 1500 and/or thesupervisor 1700 may store a map of the topology of devices of thenetworking system 1000 and/or a map of relative physical locations ofthe wireless devices (e.g., WAPs 1300 and/or endpoints) of thenetworking system 1000 to enable derivation of setting changes to becoordinated among at least a subset of the WAPs.

At 2640, the processor may then transmit commands to the network devicesfrom which the indication of the need to coordinate was originallyreceived and to the one or more other network devices to affect thederived setting changes.

FIG. 16 illustrates a flow diagram of an example implementation ofperformance of communications through a networking system. The logicflow 2700 may be representative of some or all of the operationsexecuted by implementations of one or more devices described herein.More specifically, the logic flow 2700 may illustrate operationsperformed by the processor 1110 in executing at least the securityroutine 1120, and/or performed by other components of an implementationof one of the endpoints 1100.

At 2710, a processor of an endpoint in a networking system (e.g., theprocessor 1110 of one of the endpoints 1100 in the networking system1000) may monitor the patterns of network usage and/or network/errorstatistics associated with one or more routines executed within theendpoint. More specifically, the processor may monitor and storeindications of patterns of volumes of network traffic exchanged byvarious routines (e.g., one or more of the applications 1123) throughthe network (e.g., one of the wireless links 1290) at various times ofday and/or days of a week.

At 2720, the processor may check whether a particular time of day and/orday of a week has arrived that may be associated with a particularvolume of exchange of network traffic by a particular executableroutine. If so, then at 2722, the processor may transmit an indicationof an expected pattern of volume of network usage (e.g., volume ofexchange of network traffic through one or more elements of the network)at the particular time and/or date to a WAP of the networking system(e.g., one of the WAPs 1300).

At 2730, the processor may check whether a command to affect a settingchange associated with the network performance has been received via asecure channel. If, at 2730, such a command has been received, then at2732, the processor may access the appropriate network interface of theendpoint to affect the setting change associated with change that isspecified in the command.

FIG. 17 illustrates a flow diagram of an example implementation ofperformance of communications through a networking system. The logicflow 2800 may be representative of some or all of the operationsexecuted by implementations of one or more devices described herein.More specifically, the logic flow 2800 may illustrate operationsperformed by the processor 1310 in executing at least the wirelessroutine 1329, and/or performed by other components of an implementationof one of the WAPs 1300.

At 2810, a processor of a WAP in a networking system (e.g., theprocessor 1310 of one of the WAPs 1300 in the networking system 1000)may monitor patterns of usage of a wireless link established between theWAP and an endpoint (e.g., one of the wireless links 1292 establishedwith one of the endpoints 1100). At 2820, the processor may checkwhether a particular time of day and/or day of a week has arrived thatmay be associated with a particular volume of exchange of networktraffic through the wireless link. If not, then the processor may returnto monitoring the QOS of the wireless link at 2510. However, if such aparticular time and/or date has arrived, then the processor may derive asetting change affecting the wireless link at 2822 so as to bring theQOS of the wireless link back within QOS thresholds.

At 2830, the processor may check whether effecting the derived settingchange requires setting changes at multiple endpoints. If so, then at2832, the processor may transmit requests to a firewall device or aserver that serves as a supervisor of the networking system (e.g., oneof the firewall devices 1500 or the supervisor 1700) for that firewallor supervisor to transmit commands to the security routines of thosemultiple endpoints to effect setting changes that affect the wirelesslinks by which each is coupled to a WAP of the networking system.

However, if effecting the derived setting change does not requiresetting changes at multiple endpoints at 2830, then the processor maycheck at 2840 whether the derived setting change requires a settingchange at the single endpoint associated with the wireless link forwhich the QOS has fallen outside one or more QOS thresholds. If so, thenat 2842, the processor may transmit a request to the firewall device orthe supervisor for that firewall or supervisor to transmit a command tothe security routine of the single endpoint to affect the settingchange.

Regardless of whether effecting the derived setting change requiredsetting changes at multiple endpoints, at the single endpoint, or not atany endpoint, at 2850, the processor may check whether effecting thederived setting change requires coordinated setting changes at multipleWAPs. If not, then the processor may affect the derived setting changeat the WAP at 2854, before returning to monitoring the QOS of thewireless link at 2810.

However, if coordinated setting changes are required at multiple WAPs,then at 2852, the processor may coordinate its effecting of the derivedsetting change with the effecting of corresponding setting change(s) atthe other WAP(s). As previously discussed, such coordination with one ormore other WAPs may require communication through at least one firewalldevice and/or through the supervisor, depending on the relativelocations of the WAPs to be coordinated within the topology of thenetworking system.

In this specification, references to items in the singular should beunderstood to include items in the plural, and vice versa, unlessexplicitly stated otherwise or clear from the context. Grammaticalconjunctions are intended to express any and all disjunctive andconjunctive combinations of conjoined clauses, sentences, words, and thelike, unless otherwise stated or clear from the context. Thus, the term“or” should generally be understood to mean “and/or” and so forth.Ranges of values are not intended to be limiting, referring insteadindividually to any and all values falling within the range, unlessotherwise indicated herein, and each separate value within such a rangeis incorporated into the specification as if it were individuallyrecited herein. The words “about,” “approximately,” or the like, whenaccompanying a numerical value, are to be construed as indicating adeviation as would be appreciated by one of ordinary skill in the art tooperate satisfactorily for an intended purpose. Ranges of values and/ornumeric values are provided herein as examples only, and do notconstitute a limitation on the scope of the described embodiments. Theuse of any and all examples, or exemplary language (“e.g.,” “such as,”or the like) provided herein, is intended merely to better illuminatethe invention and does not pose a limitation on the scope of theembodiments or the claims. It also should be understood that terms suchas “first,” “second,” “third,” “above,” “below,” and the like, are wordsof convenience and are not to be construed as implying a chronologicalorder or otherwise limiting any corresponding element unless expresslystated otherwise.

What is claimed is:
 1. A system to maintain security and wirelessnetwork service in a facility, the system comprising: a first wirelessaccess point (WAP) in communication with a first endpoint via a firstwireless link; a second WAP in communication with a second endpoint viaa second wireless link; and a firewall, comprising a processor and anon-transitory machine-readable medium with instructions stored thereonthat, when executed by the processor, cause the processor to performoperations comprising: establish a first secure channel with the firstWAP; establish a second secure channel with the second WAP; establish athird secure channel with the first endpoint via the first wirelesslink; establish a fourth secure channel with the second endpoint via thesecond wireless link; receive a first report from the first WAP, thefirst report including first WAP security status information and firstWAP wireless network status information; receive a second report fromthe second WAP, the second report including second WAP security statusinformation and second WAP wireless network status information; receivea third report from the first endpoint, the third report including firstendpoint security status information and wireless network statusinformation; determine network configuration changes based on the firstreport, the second report, and the third report, the networkconfiguration changes intended to improve quality of service (QOS) bybalancing an assignment of a number of endpoints, including the firstendpoint and the second endpoint, among at least the first WAP and thesecond WAP based at least in part on an indication of application usedetermined by a security routine on the first endpoint and reported tothe firewall using the third secure channel; and transmit a command toimplement the network configuration changes to the first endpoint overthe third secure channel, wherein the command directs the first endpointto end communication with the first WAP and to establish communicationwith the second WAP.
 2. A computer implemented method to maintainsecurity and wireless network service, the method comprising:establishing, by a firewall, respective secure channels with each of aplurality of wireless access points (WAPs) and each of a plurality ofendpoints; receiving, by the firewall, a plurality of reportscommunicated over the respective secure channels from the plurality ofWAPs and the plurality of endpoints, each of the plurality of reportsincluding security status information and wireless network statusinformation; deriving network configuration changes based on one or moreof the reports, the network configuration changes balancing anassignment of a number of endpoints, including the plurality ofendpoints, among the plurality of WAPs based at least in part on anindication of application use determined by a security routine on one ofthe plurality of endpoints and reported to the firewall using one of thesecure channels; and transmitting commands to at least a subset of theplurality of endpoints, the commands to direct implementation of thenetwork configuration changes.
 3. The method of claim 2, wherein thenetwork configuration changes are derived based on the security statusinformation.
 4. The method of claim 3, wherein the network configurationchanges are derived based on an occurrence of a security event.
 5. Themethod of claim 4, wherein the security event occurred on one of theendpoints of the plurality of endpoints.
 6. The method of claim 4,wherein the security event occurred on one of the plurality of WAPs. 7.The method of claim 2, wherein the network configuration changes arederived to improve network performance.
 8. The method of claim 7,wherein the network configuration changes are derived based on wirelessnetwork status information.
 9. The method of claim 7, wherein thenetwork configuration changes are derived in response to networkcongestion detected in wireless network status information.
 10. Themethod of claim 7, wherein the network configuration changes includeswitching a coupling of one endpoint of the plurality of endpoints froma coupling through a first wireless link with a first WAP of theplurality of WAPs to a coupling through a second wireless link to asecond WAP of the plurality of WAPs.
 11. The method of claim 10, whereinthe network configuration changes include changing a wireless networkchannel or data transmission rate.
 12. The method of claim 2, whereinthe balancing is based on availability of the plurality of WAPs to theendpoints.
 13. A network device, comprising a processor; and anon-transitory machine-readable medium with instructions stored thereonthat, when executed by the processor, cause the processor to performoperations comprising: establishing respective secure channels with eachof a plurality of wireless access points (WAPs) and each of a pluralityof endpoints; receiving a plurality of reports communicated over therespective secure channels from the plurality of WAPs and the pluralityof endpoints, each report in the plurality of reports including securitystatus information and wireless network status information; derivingnetwork configuration changes based on one or more of the reports, thenetwork configuration changes balancing an assignment of a number ofendpoints, including the plurality of endpoints, among the plurality ofWAPs based at least in part on an indication of application usedetermined by a security routine on one of the plurality of endpointsand reported to a firewall using one of the secure channels; andtransmit commands to at least a subset of the endpoints, the commands todirect implementation of the network configuration changes.
 14. Thenetwork device of claim 13, wherein the network configuration changesare derived based on the security status information.
 15. The networkdevice of claim 14, wherein the network configuration changes arederived based on an occurrence of a security event.
 16. The networkdevice of claim 13, wherein the network configuration changes arederived to improve network performance.
 17. The network device of claim16, wherein the network configuration changes are derived based onwireless network status information.
 18. The network device of claim 16,wherein the network configuration changes include switching a couplingof one endpoint of the plurality of endpoints from a coupling through afirst wireless link with a first WAP of the plurality of WAPs to acoupling through a second wireless link to a second WAP of the pluralityof WAPs.
 19. The network device of claim 18, wherein the networkconfiguration changes include changing a wireless network channel ordata transmission rate.
 20. A computer-implemented method to maintainsecurity and wireless network service in a facility, the methodcomprising: establishing, by a firewall, a first secure channel with afirst wireless access point (WAP) and a second secure channel with asecond WAP; establishing, by the firewall, a third secure channel withan endpoint through a wireless link between the endpoint and the firstWAP; receiving a first report from the first WAP, the first reportincluding first WAP security status information and first WAP wirelessnetwork status information; receiving a second report from the secondWAP, the second report including second WAP security status informationand second WAP wireless network status information; receiving a thirdreport from the endpoint, the third report including endpoint securitystatus information and wireless network status information; derivingnetwork configuration changes based on the first report, the secondreport, and the third report, the network configuration changes intendedto improve quality of service (QOS) by balancing an assignment of anumber of endpoints, including the endpoint, among at least the firstWAP and the second WAP based at least in part on an indication ofapplication use determined by a security routine on the endpoint andreported to the firewall using the third secure channel; andtransmitting commands to the first WAP over the first secure channel, tothe second WAP over the second secure channel, and to the endpoint overthe third secure channel, wherein the commands direct implementation ofthe network configuration changes.
 21. A network device, comprising aprocessor; and a non-transitory machine-readable medium withinstructions stored thereon that, when executed by the processor, causethe processor to perform operations comprising: establishing a firstsecure channel with a first wireless access point (WAP) and a secondsecure channel with a second WAP; establishing a third secure channelwith an endpoint through a wireless link between the endpoint and thefirst WAP; receiving a first report from the first WAP, the first reportincluding first WAP security status information and first WAP networkstatus information; receiving a second report from the second WAP, thesecond report including second WAP security status information andsecond WAP wireless network status information; receiving a third reportfrom the endpoint, the third report including endpoint security statusinformation and wireless network status information; deriving networkconfiguration changes based on the first report, the second report, andthe third report, the network configuration changes intended to improvequality of service (QOS) by balancing an assignment of a number ofendpoints, including the endpoint, among at least the first WAP and thesecond WAP based at least in part on an indication of application usedetermined by a security routine on the endpoint and reported to afirewall using the third secure channel; and transmitting commands tothe first WAP over the first secure channel, to the second WAP over thesecond secure channel, and to the endpoint over the third securechannel, wherein the commands direct implementation of the networkconfiguration changes.